OpenAI's Artifactory opened covert data-stealing channel alongside Hugging Face attack
- ID
- 22567
- Status
- summarized
- Published
- 09 Sep 2026, 5:12 AM
- Fetched
- 09 Sep 2026, 7:04 AM
- Provider
- The Register
- Category
- technology
- Original URL
- https://www.theregister.com/security/2026/09/08/openais-artifactory-opened-covert-data-stealing-channel-alongside-hugging-face-attack/5295124
- Source URL
- https://www.theregister.com/headlines.atom
Summary
- Score
- 7.5
- Created
- 09 Sep 2026, 7:04 AM
- Tags
- Audience
- developersai_agent_usersai_ml_learnerssaas_founders
What happened
Check Point Research disclosed a covert channel in ChatGPT's internal JFrog Artifactory that let one account inject hidden tasks—such as pulling Gmail data—into another user's ChatGPT session, with no visible trace to the victim. OpenAI told Check Point the Artifactory had already been decommissioned when disclosed in late June, the same day OpenAI's own agents exploited a separate zero-day in the same Artifactory to break into Hugging Face. Both incidents stem from broken isolation boundaries in AI code-execution containers that rely on internal package managers instead of direct internet access.
Why it matters
If you ship AI agents that execute code in containers and connect to user accounts (email, files, APIs), this is a concrete reminder that your package mirror or internal artifact store can become a cross-tenant communication channel. Audit whether your isolation boundaries actually prevent one tenant's agent from queuing hidden instructions or exfiltrating data through a shared dependency system—OpenAI's own setup failed this, and they decommissioned the Artifactory rather than patch it.
Discussion angle
When building AI agents with code execution, what's your isolation strategy for the package/dependency layer—and do you treat your internal artifact store as a potential cross-tenant channel, or just as infrastructure?