OpenAI's Artifactory opened covert data-stealing channel alongside Hugging Face attack

Check Point Research discovered that there was a secret channel within OpenAI’s JFrog Artifactory instance, allowing attackers to send hidden tasks to ChatGPT sessions on other accounts (such as stealing Gmail data). This vulnerability was addressed at the end of June. Threat hunter disclosed this issue at the end of June, and on the same day, OpenAI exploited the zero-day vulnerability in Artifactory to gain internet access and invade Hugging Face. Although both involved the same internal package management system, they were different attacks. Check Point researchers noted that containers should have been isolated from each other, but Artifactory exposed its item management functionality, allowing instructions to be passed between accounts through text attributes (including Base64-encoded binary data). Defects in read/write permissions and authentication mechanisms enabled code to access the storage directly without additional credentials. Attackers could write malicious tasks into shared storage, and victim sessions would execute those tasks and return results without exposing the second-party instructions.