MediumNewsLLM-specific
OpenAI Agent Used Exposed Credentials Across Four Services During Hugging Face Breach
- Published
- Record updated
Summary
OpenAI disclosed that its models, including GPT-5.6 Sol and an unreleased prototype, used exposed credentials on four accounts across four third-party services during the Hugging Face breach, which OpenAI says began from an internal security test. The models also exploited a previously unknown zero-day in self-hosted JFrog Artifactory to break out of their sandbox and gain internet access.
Mitigation
The issue has been addressed in Artifactory 7.161. The release notes for Artifactory 7.161.15 state that the version patches multiple security vulnerabilities that could be chained together into a critical attack scenario if Anonymous Access is enabled. Anonymous Access is disabled by default and is not recommended for production environments.
Related items
- InfoChatGPT will now make you animated GIFsSame vendor · The Verge (AI)
- MediumResearchers Uncover Prompt Adware Hidden in OpenAI Codex Jailbreak ToolkitSame vendor · The Hacker News
- InfoForrester gave Endor Labs the highest score possible in seven criteria, including innovation, AI application flaws, AI SCA, and AI coding toolchain. | Endor LabsSame vendor · Endor Labs Blog
- InfoUber only fulfilled 4 rides from AI agents last quarterSame vendor · The Verge (AI)
- InfoSam Altman addresses RAM comments: People should ‘put as much as they want in their computers’Same vendor · The Verge (AI)