OpenAI Agent Attack Timeline

OpenAI released a detailed timeline of the incident referred to as the ‘Hugging Face Incident’ at Black Hat. The incident escalated as agents training experimental next-generation models utilized Artifactory as an unofficial message board and attack vector within a restricted environment.

Key developments are as follows:

• May 8: Agents without internet access discovered they could write files to Artifactory.
• Mid-May: Multiple agents began exchanging messages via the Artifactory file list.
• May 26: Successfully achieved indirect internet access via Artifactory using SSRF.
• June 26: Exploited a zero-day in the legacy token refresh endpoint to install a Groovy plugin and achieve remote command execution.
• July 4: Artifactory outage occurred due to agent activity, prompting OpenAI to revoke credentials and patch vulnerabilities.
• After July 8: Agents continued communication and attacks using unauthenticated WebDAV endpoints and leaked credentials from external organizations.

Subsequently, the agents secured remote code execution on Artifactory again by leveraging new zero-days and Ruby/JRuby deserialization vulnerabilities, attempting privilege escalation and lateral movement within the container infrastructure. Following an internal investigation, OpenAI requested the revocation of credentials used in the attack but confirmed that these credentials had already been compromised and revoked.