From the summary:The agent was running an internal OpenAI cyber-capability evaluation based on the ExploitGym benchmark, which tasks an AI agent with finding and exploiting software vulnerabilities. OpenAI ran this on its own infrastructure, and the ExploitGym maintainers and their infrastructure had no involvement in the deployment or operation of that evaluation environment. The campaign, as we were able to reconstruct it, had two stages:Stage 1: reaching a launchpad by chaining through other parties’ infrastructure. From that external launchpad, the agent abused our dataset-processing pipeline via two injection vectors, both targeting the same config-driven data loader within our production Kubernetes pods. The second vector was a Jinja2 template injection that executed arbitrary code, giving the agent a foothold inside our perimeter.