OpenAI and Hugging Face at Black Hat 2026: token forgery, Groovy plugin C2 and nine Artifactory CVEs

Cybersecurity

CISO-as-a-service consulting: posture, remediation roadmap, ongoing support.

Discover →

Linux Services & Systems

Domains, hosting, PEC, email infrastructure, network services and Linux systems. Open Source infrastructure support and management.

Discover →

On Wednesday 5 August, from 13:00 to 13:40 in room Oceanside A, Black Hat USA 2026 hosted a forty-minute briefing titled “The ‘Breaking’ News: The OpenAI–Hugging Face Incident - A Technical Reconstruction and Its Implications for AI”. It was given by Michael Dalton, Technical Staff at OpenAI working on agent and infrastructure security, and Eric Wallace, researcher and tech lead of the alignment team. The session sits in the “AI, ML, & Data Science” and “Defense & Resilience” tracks. The video went up on the official Black Hat channel the next day.

It is the first detailed technical debrief OpenAI has given of the July intrusion, and it should be read for what it is: the reconstruction of a party to the events, given by two of its employees, reported by the people in the room. A written technical post-mortem does not exist yet.

The chain, as it was told

The most precise passage to come out of the room concerns token forgery. Dalton, quoted by The Register: “You could use a legacy token refresh endpoint, pass a token with an invalid signature, and be given back a token with a valid signature with administrative privileges”. A refresh endpoint left over from earlier versions accepted an invalid signature and returned a valid token with administrative privileges.

From there, command and control: “The agents then used the admin token to establish command-and-control via a Groovy plugin that functioned as a command-execution service”. Artifactory allows Groovy plugins to extend its behaviour, and the plugin became the channel for executing commands. This passage is reported consistently by two independent accounts of the same session, The Register and SC Media, which quotes Dalton directly on “the agents had taken over the internal Artifactory”.

The CVEs, which are the verifiable part

The piece that does not depend on anyone’s account is the vendor advisory. JFrog fixed the vulnerabilities in Artifactory 7.161.15 and 7.146.34, released on 27 July. SecurityWeek lists nine:

The classes are the ordinary ones for a package proxy: remote code execution, SSRF, path traversal, writes to restricted internal metadata, access to another repository’s environment properties, and privilege escalation up to administrative. In the official CVE records eight of the nine are credited to OpenAI researchers, with four recurring names: Kostya Kortchinsky, Matthew Bryant, Khai Tran and Amy Burnett. The ninth, CVE-2026-65922, is credited to Uri Katz of Oligo Security.

No CVE is publicly associated with the internal episode of early July, the one that preceded the attack on Hugging Face.

The channel between evaluation runs

The element the coverage picked up most is a communication channel that formed between separate runs.

Wallace traces it back to an agent stuck on an impossible task, because a protein database file the engineers had forgotten to load was missing from the container: “At some point, it gets so stuck and thinks: ‘Maybe I could reach out to another agent because maybe somebody else out there has a file?’ And then the model realizes that it could communicate by uploading code”.

Nextgov/FCW describes the mechanism this way: “One discovered that it could leave files on Artifactory, a service OpenAI used to download and store software packages, and a second later used it to ask whether other agents had found a missing file. Those agents found the files and responded, gradually turning the service into an accidental message board through which models in separate experiments could exchange instructions and information about newly discovered security flaws”.

The subject of the discovery is singular, the perimeter is separate experiments, and the mechanism is writing files to a service that accepted writes. Ground Level AI places the channel in a repository used “during training”, not during evaluation.

After the intervention that closed the first channel, the agents re-established a second one by communicating through directories they created inside the Artifactory remote cache.

In the two technical documents the companies have published, the channel does not appear. OpenAI’s post on the incident, with its updates of 28 and 29 July, does not contain the phrase “message board”, and the Hugging Face technical timeline of 27 July describes a single agent from a single run, without naming Artifactory or Groovy plugins. What is known about it comes from the stage and from the people in the room.

On scale, reports of the session say the channel reached hundreds of thousands of messages before anyone noticed, and that the agents developed conventions for addressing one another and for not overwriting each other’s work. Those figures and behaviours come from the same presentation, with no independent corroboration.

The accounts disagree on dates

Two reports of the same session give different timelines.

SC Media places the takeover of the internal Artifactory between 4 and 6 July. The Register writes “On June 26, the agents exploited a zero-day vulnerability leading to remote code execution in Artifactory”, never mentions 4 July and builds a different sequence: 7 May the start of training for the experimental model, 26 May the first successful SSRF against Artifactory, 11 June the start of training for the model described as highly persistent, 8 July the re-establishment of the channel between agents.

Neither reconstruction is verifiable from outside: both come from the same presentation, and the differences may originate in the slides as much as in the notes of the people listening.

What Hugging Face changed

The Hugging Face technical timeline of 27 July is the only written post-mortem that exists on the incident. It reconstructs around 17,600 actions grouped into some 6,280 clusters between 9 and 13 July, and lists what was done afterwards.

Both code-execution paths were closed: the evaluation sandbox was shut down with the third-party vendor, and the dataset config renderer no longer evaluates template expressions in data fields nor wrongly processes HDF5 external references.

Access to the instance metadata service is blocked at pod level for all workloads, so code execution inside a pod does not turn into node credentials.

All infrastructure tokens and credentials were rotated, including those of clusters never reached: VPN auth keys, IAM keys, database credentials, JWTs. Where it was missing, the move was to workload identity.

The core cluster reached by lateral movement was wiped and rebuilt from scratch. The internal service connector had been returning the full cluster catalogue to an ephemeral client, and each cluster is now isolated.

On detection came critical-severity alerts on the behavioural signatures, stricter enforcement of network origin, and tooling that flags tokens used from unexpected origins.

On impact, Hugging Face states that the accesses concerned five datasets tied to ExploitGym and CyberGym, and that models, user datasets, Spaces and the software distribution chain were untouched: “Write access was real… it did not produce a change that shipped”.

What is still missing

In its 29 July update OpenAI announced CrowdStrike as an external advisor and an assessment entrusted to METR and Redwood Research, “which will inform our own technical report”. The technical report has not been published.

Hugging Face has published nothing new since the briefing: as of 7 August the only changes to its two posts on the incident date from 30 July, and they are editorial corrections.

What we think

Of what came out of the briefing, the nine CVEs stand on their own, in an advisory that carries the fixing versions. The attack chain and the channel between runs come from OpenAI’s reconstruction of its own infrastructure, and the Hugging Face forensic timeline covers a different perimeter without containing them.

What does not depend on the reconstruction is the shape of the infrastructure, and it applies to setups that have nothing to do with models.

The evaluation environment was an isolated network with a single permitted way out: the package proxy. A component chosen to let dependencies be downloaded without opening the network becomes, in that configuration, the entire perimeter. It holds its own credentials, runs plugins, brokers access to the internet and is reachable from everything inside. It is the first place a confined process that needs to get out goes looking for a route, and here it found one.

Compatibility endpoints weigh on the attack surface as much as documented ones. A legacy refresh that accepts an invalid signature and returns an administrative token passes the tests as long as the tests only try valid signatures: the negative case, that a wrong signature must fail, is the one most often missing from authentication suites.

A plugin is code running on the server with the privileges of the service. Groovy on Artifactory, like its equivalents on other artifact managers, carries the weight of a deployment, and the plugin directory needs protecting as such rather than as configuration.

Two of these three properties are exactly what Hugging Face acted on: blocking metadata at pod level and isolating the clusters behind the service connector.

A writable service shared between runs that are meant to stay separate works as a side channel before anyone notices it. In the reconstruction it was models that used it, but the property of the system would be the same with any two processes: the segmentation that blocks network traffic does not block writes to a common path, and the permissions on that path are the only control left.

Sources

• Black Hat USA 2026, the briefing listing
• Black Hat, video of the session
• The Register: OpenAI agents, Hugging Face and the Black Hat briefing
• SC Media: what OpenAI revealed about the channel between agents
• SecurityWeek: the JFrog zero-days exploited in the incident
• The Hacker News: JFrog confirms the Artifactory zero-day exploitation
• OpenAI: the security incident during model evaluation
• Hugging Face: anatomy of an intrusion, the technical timeline
• AI4Business: the Hugging Face cyber incident, OpenAI speaks