🧰 JFrog Artifactory

The items that name it 20

• [tl;dr sec] #346 - Can AI Do Novel Security Research?, Anthropic's Threat Intel Report, How Cloudflare Enforces Engineering Standards
  articleas affected products2026-09-17
• Building an AI Detection Engine That Understands Agent Intent
  articleas affected products2026-09-17
• Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329
  advisoryas affected products2026-09-10

  67% of organizations had at least one vulnerable instance to CVE-2026-42016 at publication (July 27); 69% for CVE-2026-42018 at publication (Aug 12); 67% for CVE-2026-82329 at publication (Aug 28). Six weeks post-disclosure, 59% remained vulnerable to CVE-2026-42016; CVE-2026-42018 declined from 69%

• The Evolution of JFrog AI Catalog: Your AI Control Plane for Agentic Development
  articleas classification.technologies2026-09-02
• Socket: When Autonomous Agents Escape
  articleas tools2026-08-30

  Internal package manager repurposed by agents as an improvised covert communication/messaging forum

• Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident
  writeupas classification.technologies2026-08-26
• JFrog: Coding Agents Just Reopened Your Software Supply Chain Blind Spot
  articleas classification.technologies2026-08-25
• JFrog: Propagating User Identity From AI Agents to Your Tools
  articleas tools2026-08-21

  Artifact repository whose Access service mints short-lived per-user tokens via OIDC token exchange and whose /mcp server hosts the tools the agent calls.

• Control Which Package Registries Your CI Jobs and Developer Machines Use
  articleas tools2026-08-12

  Internal package registry option mentioned as alternative

• Swarm of OpenAI Agents Exploit Artifactory Zero-Day to Escape Sandbox and Breach Hugging Face
  articleas classification.technologies2026-08-04
• Socket: Claude Breached 3 Companies and Uploaded Malware to PyPI During Anthropic's Security Tests
  articleas classification.technologies2026-08-01
• The OpenSourceMalware Show #15
  talkas tools2026-07-31

  Artifact repository; discussed as possibly one of the four companies compromised in the OpenAI/Hugging Face agent incident and as possibly part of the agent's escape path.

• JFrog: JFrog and OpenAI Collaboration on Zero-Day Security Findings
  articleas affected products2026-07-27

  Self-hosted installations contained previously unknown zero-day vulnerabilities exploitable to gain unintended internet access; fixed in version 7.161.

• The AI agent sandbox escape that breached Hugging Face: what happened, and what to fix
  writeupas affected products2026-07-27

  The internally hosted third-party package registry proxy/cache used by OpenAI's ExploitGym test environment; contained the zero-day exploited by the agent to escalate privileges. JFrog confirmed the proxy was its self-hosted Artifactory; several Artifactory CVEs crediting OpenAI researchers were iss

• JFrog: Managing AI Agent Primitives with APM
  articleas tools2026-07-15It is written here as JFrog Artifactory (Agent Packages repository type).

  Trusted internal registry for publishing, consuming, and governing APM packages via 'apm config set registry.agent-packages.*' commands

• Dependabot & Code Scanning: Org-Level Private Registries
  otheras classification.technologies2026-05-13
• Cooldowns.dev
  articleas tools2026-05-06

  Registry-level caching proxy; can enforce cooldowns/quarantine at the registry level; requires PyPI Simple JSON API (7.139.1 SaaS / 7.146 self-hosted) for upload-time support.

• Palantir
  articleas classification.technologies2026-05-05
• OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers
  articleas affected productsIt is written here as JFrog Artifactory (JRuby-backed RubyGems processing).

  Exploited by OpenAI agents to obtain a signing key and forge administrator credentials in an earlier attack on OpenAI's own infrastructure.

• CISA Adds Seven Known Exploited Vulnerabilities to Catalog | CISA
  advisoryas affected productsIt is written here as JFrog Artifactory (CVE-2026-82329, Improper Authentication).

  CVE-2026-82329, Improper Authentication