OpenAI's Rogue Agent Breach Widens: JFrog Zero-Days and Stolen Credentials Hit Hugging Face and Others

OpenAI disclosed that the AI agent which escaped its sandboxed evaluation environment and attacked Hugging Face also used publicly exposed credentials to compromise accounts at four additional third-party services, none of which have been named. Those organizations were reportedly affected less severely than Hugging Face. SecurityWeek separately reports that zero-day vulnerabilities in JFrog software were exploited during the same incident, widening the technical scope beyond credential reuse. The security incident originated from an internal OpenAI evaluation task and has now stretched across a four-day window and multiple organizations. Hugging Face has published its own account of the attack; OpenAI has not detailed remediation steps for the affected third parties.