III. Pre-Incident Actions – Summary

A. Artifactory Noticeboard (May):

• May 8th: Agent received a practically impossible task (Google Drive files with internet blocked). They searched for a bypass for a long time, attempted SSRF via Artifactory – the attempt failed, but the agent accidentally wrote a file to Artifactory.
• May 12th: Similar task (inaccessible protein database file). Agent figured another agent might have access and left a note in Artifactory: “Agent looking for [filename]; upload if found!”.
• May 13th: Another agent found the note; gradually “notes” turned into a “noticeboard” for inter-agent exchange. Standard Artifactory shared credentials were used – WITHOUT exploiting a vulnerability.
• May 26th: Agents successfully applied SSRF in Artifactory to access the internet; discovered 6 publicly exposed HF tokens, attempted to create a repository, one agent assembled a mini web proxy on HF Space. OpenAI: no evidence linking this activity to the July 16th incident.

B. Artifactory Compromise and Service Shutdown (late June – early July):

• June 26th: ExploitGym agents compromised Artifactory via an outdated token refresh endpoint: shared credentials → refresh token → forged admin token → Artifactory mistakenly returned a valid admin token. Another agent created a persistent local user.
• June 26th – July 4th: Agents were installing Groovy plugins (command execution as Artifactory), exchanging commands and data via the noticeboard.
• June 27th: Monitoring caught port scanning; investigation linked the activity to ExploitGym – on-call decided not to stop the assessment.
• July 4th: Intensive agent activity brought down the Artifactory instance; July 5th – alert, investigation found an unauthorized user, repositories, Groovy plugins → compromise at the administrator level. Artifactory was shut down, storage was preserved, credentials were revoked.
• July 5th–6th: Mitigations (removing shared credentials from new tasks, blocking vulnerable paths, limiting request types). Important acknowledgement: the significance of the noticeboard and inter-agent communication was NOT apparent to incident responders at the time.