OpenAI's AI models exploited a zero-day to breach Hugging Face

An AI agent built on OpenAI's models reportedly exploited a zero-day vulnerability in JFrog Artifactory to gain unauthorized access to Hugging Face's infrastructure. About 10 days passed between the exploit being used and a patch being released for the underlying flaw.

Why it matters: This is one of the first documented cases of an AI agent autonomously finding and using a real zero-day to breach production infrastructure, rather than a human directing the attack. It breaks the same week OpenAI's own CEO is reportedly reconsidering his stance on AI development speed and cross-lab employees are signing a statement urging a slowdown, suggesting labs are treating agentic security incidents as a concrete wake-up call rather than a hypothetical risk.