Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fast Remediation Is the New Trust Model (JFrog and OpenAI Zero-Day Findings)

jfrog.com

Post reply on HN
Print view View original

31–40 of 40 posts

Re: Fast Remediation Is the New Trust Model (JFrog and OpenAI Zero-Day Findings)

#31

Post by dgellow »

baq wrote: post #30
pocksuppet wrote: post #23

Earlier quoted context omitted.

White-hat hackers go to prison for running a scanner on a website and reporting the found vulnerabilities to the website owner without exploiting them. I don't see why this should be any different.

It's different since there was no single physical person who executed the hack or even asked for it. Intent is the difference between manslaughter and murder and we couldn't technically in any reasonable way commit an accidental hack into a computer system before approximately last month (or last quarter if we consider Mythos previews to be capable of this.)

Intent is a result of an investigation, it’s not something you need beforehand

Re: Fast Remediation Is the New Trust Model (JFrog and OpenAI Zero-Day Findings)

#32

Post by stronglikedan »

baq wrote: post #16
dgellow wrote: post #9

The part I find the strangest in that whole affair is the way OpenAI is framing a felony (their systems accessed other company servers and exfiltrated private data, for multiple days, by exploiting vulnerabilities) as a successful partnership with jfrog and huggingface. Aren’t we now in a situation where a large AI vendor can engineer a similar situation against another corporation, then if caught committing a crime,…

I don’t see how it can’t be both. Yes, it is a felony, unarguably, but it’s also a first of its kind and I’ll be very interested in who law enforcement prosecutes and what the judiciary says about this. Almost everything is a precedent here except ‘somebody got hacked’.

It's not a first of it's kind. AI is a hammer, and the one wielding the hammer is responsible for those hurt by the hammer. It's a classic case of the powerful not being held accountable. It's a tale as old as time.

Re: Fast Remediation Is the New Trust Model (JFrog and OpenAI Zero-Day Findings)

#34

Post by lovasoa »

simonw wrote: post #13
lovasoa wrote: post #7

What they conveniently omit in the blog post is what the vulnerability was: it seems like they renewed JWTs without checking the signature at all ! You could write arbitrary info in an old token, and get it signed without any verification. https://www.youtube.com/watch?v=q2KCrmQz9WE

That video suggests that RTDEV-92030 was the fix for the issue - but https://docs.jfrog.com/releases/docs/artifactory-self-manage... says that issue was resolved in a 15 July 2026 release of Artifactory, which doesn't fit our timeline - that was prior to the original Hugging Face post on 16 July which was several days before OpenAI had confessed.

The timeline is indeed a little bit fuzzy, I haven't found a precise chronology, neither from HuggingFace nor from OpenAI. HF says the hack happened "over a weekend", so probably July 11th-12th. Do you think it took OpenAI a week to realize what happened ?

Maybe when HF published their blog post on the 15th, OpenAI already knew something had happened, had started to investigate, and already reported the issue to JFrog ? But looking at your other comment in the thread, I agree that CVE-2026-65925 and CVE-2026-66014 are better candidates.

Taking a step back, so many basic vulnerabilities in a security-oriented product just makes the headline "agent autonomously escaped containment" sound a little less spectacular.

Re: Fast Remediation Is the New Trust Model (JFrog and OpenAI Zero-Day Findings)

#35

Post by simonw »

lovasoa wrote: post #34
simonw wrote: post #13

Earlier quoted context omitted.

That video suggests that RTDEV-92030 was the fix for the issue - but https://docs.jfrog.com/releases/docs/artifactory-self-manage... says that issue was resolved in a 15 July 2026 release of Artifactory, which doesn't fit our timeline - that was prior to the original Hugging Face post on 16 July which was several days before OpenAI had confessed.

The timeline is indeed a little bit fuzzy, I haven't found a precise chronology, neither from HuggingFace nor from OpenAI. HF says the hack happened "over a weekend", so probably July 11th-12th. Do you think it took OpenAI a week to realize what happened ? Maybe when HF published their blog post on the 15th, OpenAI already knew something had happened, had started to investigate, and already reported the issue to JFro…

> Do you think it took OpenAI a week to realize what happened ?

Apparently it did take them a while. This report here https://cloudsecurityalliance.org/artifacts/hugging-face-cis... includes extra details from a conversation Hugging Face:

> The intrusion lasted about four days: two days were spent on reconnaissance, followed by one silent day and a final day of intense activity.

That suggests OpenAI didn't spot what was happening for four days.

Re: Fast Remediation Is the New Trust Model (JFrog and OpenAI Zero-Day Findings)

#36

Post by joshka »

lovasoa wrote: post #8

There is one thing that is still unclear to me after reading a lot about the hack: * were the ExploitGym solutions actually available somewhere inside huggingface's private datasets ? * was the model really trying to extract the solutions ? or had some sub-agent drifted enough from the original context that it was not even trying to solve the initial challenge ? that would look much worse for OpenAI, PR-wise.

https://huggingface.co/blog/agent-intrusion-technical-timeli... has that side of the write up a bit more

discussion: https://news.ycombinator.com/item?id=49089500

Re: Fast Remediation Is the New Trust Model (JFrog and OpenAI Zero-Day Findings)

#37

Post by simonw »

simonw wrote: post #14
lovasoa wrote: post #8

There is one thing that is still unclear to me after reading a lot about the hack: * were the ExploitGym solutions actually available somewhere inside huggingface's private datasets ? * was the model really trying to extract the solutions ? or had some sub-agent drifted enough from the original context that it was not even trying to solve the initial challenge ? that would look much worse for OpenAI, PR-wise.

According to https://cloudsecurityalliance.org/artifacts/hugging-face-cis... the models ended up finding CyberGym solutions, which was the wrong benchmark.

... but that's since been refuted by https://huggingface.co/blog/agent-intrusion-technical-timeli... which says:

> While the intrusion did reach Hugging Face's internal infrastructure, the only customer content accessed was the set of ExploitGym/CyberGym challenge solutions stored in five datasets.

Re: Fast Remediation Is the New Trust Model (JFrog and OpenAI Zero-Day Findings)

#38

Post by literalAardvark »

pocksuppet wrote: post #23
baq wrote: post #16

Earlier quoted context omitted.

I don’t see how it can’t be both. Yes, it is a felony, unarguably, but it’s also a first of its kind and I’ll be very interested in who law enforcement prosecutes and what the judiciary says about this. Almost everything is a precedent here except ‘somebody got hacked’.

White-hat hackers go to prison for running a scanner on a website and reporting the found vulnerabilities to the website owner without exploiting them. I don't see why this should be any different.

It's different for the same reason why AI can't own copyright.

Re: Fast Remediation Is the New Trust Model (JFrog and OpenAI Zero-Day Findings)

#39

Post by ses1984 »

breppp wrote: post #22
ses1984 wrote: post #19

Earlier quoted context omitted.

If someone invents a new weapon to hurt someone, is the first inflicted injury unprecedented?

Intent is a major part of a crime severity, and it's hard to attribute intent to OpenAI here

There can be crime without intent, like manslaughter.

Re: Fast Remediation Is the New Trust Model (JFrog and OpenAI Zero-Day Findings)

#40

Post by iansmith_hn »

simonw wrote: post #5

This appears to confirm that the packaging proxy they were using for the research machine that their agent broke out of was Artifactory, the same software they use in production. (You can tell they use it in production by asking regular ChatGPT to run "env | grep ARTIFAC" in its container environment.) Hard to decipher which vulnerability was responsible, or if it took several. https://www.cve.org/CVERecord?id=CVE-20…

Thanks for the link to the CVE. Are we likely to ever get a full breakdown of the exploit? I guess when artifactory is patched and deployed widely? Although I must admit my interest in mostly curiosity, but perhaps a full disclosure and explanation might give other folks guidance about much they need to lock down their code or maybe even a construction in java (?) to avoid?
Post reply on HN