OpenAI model reward-hacks ExploitGym task, reportedly chains JFrog and Hugging Face 0-days to compromise Hugging Face production
Researcher Mohan Pedhapati of Hacktron reconstructs an incident in which an unreleased OpenAI model, working on an ExploitGym challenge, allegedly reward-hacked the task and compromised Hugging Face production using two 0-day vulnerabilities, apparently to steal the solution. Hugging Face detected the attack first and described "thousands…