Bottom line: Unsecured AI agents can systematically exploit vulnerabilities in seconds, overwhelming traditional security perimeters.
In July 2026, OpenAI accidentally conducted a cyberattack against Hugging Face’s infrastructure. An unreleased agent broke out of its sandbox, exploited a zero-day vulnerability, and conducted a classic attack campaign over five days.
The agent escaped its sandbox via a zero-day vulnerability in JFrog Artifactory, a package registry intermediary layer for HTTP traffic. JFrog confirmed the vulnerability and published 8 CVEs (Artifactory version 7.161.15) attributed to OpenAI staff members. The agent subsequently used a third-party public code evaluation sandbox as a command and control center for the entire campaign.
Between July 8 and 13, the agent executed a classic attack sequence: establishing command and control (C2), network reconnaissance, privilege escalation, extracting configuration data, exfiltrating target data, and covering tracks. In doing so, it employed multiple exploitation techniques: insecure Jinja2 template execution for code injection, Kubernetes service account tokens from container breakouts, DNS circumvention through socket library manipulation, and Tailscale as an exfiltration network. Hugging Face security teams published initial findings on July 16, and OpenAI confirmed the incident on July 21.