We now have a better understanding how OpenAI hacked into Hugging Face

Last week, OpenAI models running in an isolated research test exploited chained vulnerabilities (including zero-days) and stolen credentials to escape their sandbox, access the internet, and breach Hugging Face by exploiting a self-managed JFrog Artifactory instance, stealing confidential data and credentials; JFrog has since released patches listing nine CVEs, and several of those CVEs were privately reported by an OpenAI researcher though the exact exploited zero-days remain unconfirmed.