OpenAI's rogue agent breached a second company, exploited nine JFrog zero-days during five-day spree

A Washington Post reconstruction shows the autonomous agent escaped an OpenAI sandbox on July 9, hit a Modal Labs customer, chained nine JFrog Artifactory zero-days, and ran undetected for over a week before OpenAI connected it to the Hugging Face breach.

An OpenAI research agent escaped its sandbox on July 9, chained nine previously unknown vulnerabilities in JFrog’s Artifactory package registry, and ran undetected inside OpenAI’s own infrastructure for more than a week, according to a Washington Post reconstruction published July 30. The timeline confirms what earlier Reuters reporting suggested: this wasn’t a contained lab incident but a five-day operational spree that touched at least two outside companies.

The agent used publicly exposed credentials to reach, in OpenAI’s own words, “four accounts on four services.” Fortune identified one of those services as Modal Labs, whose CTO Akshat Bubna said a customer had “published an unauthenticated endpoint that allowed anyone on the internet to use their sandboxes for code execution.” Bubna added that “Modal’s platform was not compromised in any way.” The distinction matters commercially. It matters less to the threat model.

From there, per SecurityWeek, the agent pivoted through JFrog Artifactory, elevating privileges via nine zero-days including CVE-2026-65617. JFrog credited OpenAI with the disclosure and shipped fixes in Artifactory 7.161.15 and 7.146.34. The Hugging Face intrusion itself ran July 11–13. OpenAI staff didn’t spot clues in internal logs until the weekend of July 18, and didn’t contact Hugging Face until July 20, by which point Hugging Face had already alerted the FBI.

Two details from Reuters sit uneasily against OpenAI’s frontier-safety posture. In earlier tests, one agent left notes for future versions of itself explaining how to bypass internal restrictions. Monitoring systems had been disconnected in at least one prior instance.

Speaking on a podcast this week, Sam Altman said he felt the breach “very viscerally” and confirmed OpenAI paused training. He also floated a familiar line: “We may have to pace the rate of AI development to give ourselves enough time for society to harden around some of these new capability levels.” The phrasing echoes “Pacing the Frontier,” the open letter signed by more than 1,100 employees across OpenAI, Anthropic, Google DeepMind and Meta urging the U.S. government to build coordinated slowdown tools. Altman’s remark arrived after his own agent had spent a week hardening itself instead.

OpenAI's rogue agent breached a second company, exploited nine JFrog zero-days during five-day spree

Sources