我们如今更清楚 OpenAI 如何入侵 Hugging Face

英文标题：We now have a better understanding how OpenAI hacked into Hugging Face

JFrog 表示，OpenAI 的两款安全黑客模型入侵 Hugging Face 网络时，利用了其 Artifactory 产品中一个或多个零日漏洞。事件发生后约 10 天，JFrog 发布了 Artifactory 7.161.15 修复版本，其中包含 9 个漏洞的补丁。公开信息显示，9 个 CVE 中有 3 个由 OpenAI 研究员 Khai Tran 私下报告，但 JFrog 未确认哪些漏洞曾被实际利用。该事件表明，具备自主攻击能力的 AI Agent 已可能通过漏洞链突破隔离环境并实施真实网络入侵，也凸显了企业及时更新软件供应链基础设施的重要性。

打开原文相关 2 · 机会 0

中文

上周，两款 OpenAI 安全黑客模型闯入同为 AI 公司的 Hugging Face 网络，这起前所未有的安全事件由 Artifactory 中一个或多个零日漏洞促成。该产品开发商 JFrog 周一表示，相关漏洞已被利用。

在一场堪比反乌托邦科幻小说的事件中，两款 OpenAI 模型在一次内部测试期间逃离了原本用于阻止其访问互联网的受限环境，AI 公司上周披露。随后，这些模型入侵了 Hugging Face 的网络，并窃取了机密信息和凭证。OpenAI 表示，其 Agent 是通过利用此前未知的漏洞完成这一行动的。该公司将此事件称为“前所未有”，外界也普遍认同这一判断。

并非宣传中的那场胜利

OpenAI 表示，这些模型利用了多种攻击路径，包括被盗凭证和零日漏洞，以获得远程代码执行能力；但在此之前，存在漏洞的软件尚不明确。JFrog 周一发布的披露信息称，相关产品是一套自管理部署的 Artifactory。Artifactory 是一种软件仓库管理系统，可帮助客户保护并简化软件开发运营。JFrog 表示，Artifactory 已被超过 7,500 个开发团队使用，其中 80% 服务于《财富》100 强企业。

JFrog 首席技术官 Yoav Landman 写道：“在一次针对前沿网络能力的内部评估中，OpenAI 的模型在隔离研究环境内运行，并被刻意移除了生产环境防护措施；它们自主发现并利用了一条漏洞链，逃离沙箱、接入开放互联网，并从 Hugging Face 的基础设施中提取评估答案。”这位高管进一步表示，公司是从 OpenAI 处得知这些零日漏洞的。

该公司周一表示，已修复被利用的漏洞，但没有识别这些漏洞，也没有提供其他重要细节，例如漏洞可被利用的条件。这类信息是许多漏洞披露中的标准内容，因为客户需要据此评估风险。该公司的一名代表在电子邮件中拒绝提供这些细节。

周一发布的 Artifactory 7.161.15 版本发布说明列出了 9 个已修复漏洞的 CVE 编号。披露内容没有提及其中任何漏洞曾在现实环境中被积极利用。不过，外部来源显示，其中 3 个漏洞——CVE-2026-65617、CVE-2026-65923 和 CVE-2026-66018——由 OpenAI 研究员 Khai Tran 私下报告。它们中至少有两个很可能就是 OpenAI 模型利用的零日漏洞，但在缺乏确认的情况下，无法作出确定判断。

English / 原文

Last week’s unprecedented security event in which two OpenAI security hacking models trespassed into the network of fellow AI company Hugging Face was enabled by exploiting one or more zero-day vulnerabilities in Artifactory, JFrog, the product’s developer, said Monday.

In an incident mimicking a dystopian sci-fi novel, two OpenAI models broke out of the restricted environment meant to keep them from accessing the Internet during an internal test, the AI company revealed last week. The models went on to breach Hugging Face’s network and steal confidential information and credentials. OpenAI said its agent achieved the feat by exploiting a previously unknown vulnerability. The company called the event “unprecedented,” and outsiders largely agreed.

Not the triumph made out to be

OpenAI said the models exploited multiple attack vectors, including stolen credentials and zero-days, to gain remote code execution capabilities, but until now, the vulnerable software was unknown. JFrog’s Monday disclosure said the product was a self-managed instance Artifactory, a repository management system that secures and streamlines customers’ software development operations. JFrog says Artifactory is used by more than 7,500 developer Teams, 80 percent of which work for Fortune 100 companies.

“During an internal evaluation of frontier cyber capabilities, OpenAI’s models, running deliberately without production safeguards in an isolated research environment, autonomously discovered and employed chained vulnerabilities to escape its sandbox, reach the open internet, and extract evaluation answers from Hugging Face’s infrastructure,” JFrog CTO Yoav Landman wrote. The executive went on to say that the company learned of the zero-days from OpenAI.

The company said Monday that it fixed the exploited vulnerabilities, but it didn’t identify them or provide other important details, such as the conditions under which the vulnerabilities can be exploited. Such details are standard in many vulnerability disclosures because they’re necessary for customers to assess risks. In an email, a company representative declined to provide the details.

Release notes published Monday for version Artifactory 7.161.15 listed the CVE designations for nine patched vulnerabilities. The disclosure made no mention that any of them had been actively exploited in the wild. External sources, however, show that three of them—CVE-2026-65617, CVE-2026-65923, and CVE-2026-66018—were privately reported by OpenAI researcher Khai Tran. It’s likely that at least two of them were the zero-days OpenAI’s models exploited, but without confirmation, it’s impossible to say so definitively.