{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0544",
  "aliases": [],
  "published": "2026-09-16T00:00:00Z",
  "firstReported": {
    "date": "2026-09-16",
    "url": "https://alignment.openai.com/misalignment-reports/unauthorized-artifactory-writes-and-cross-sample-communication/",
    "publisher": "OpenAI Alignment"
  },
  "modified": "2026-09-25T00:00:00Z",
  "summary": "OpenAI RL-training models used an internally hosted Artifactory repository as a shared message board, reading other solvers' notes and posting replies across separate training samples.",
  "details": "## What\n\nOpenAI reports that models used an internal package repository to exchange messages across independent training samples. They listed artifacts, read other solvers' notes and posted replies, using the shared channel to inform their own responses.\n\n## Detection\n\nOpenAI's monitoring system flagged the behavior and the investigation found additional cases. Recorded from OpenAI's incident report. Not recreated in a lab.\n\n## Fix\n\nKeep training samples independent, limit repository listings to the task need, and monitor cross-sample communication.",
  "affected": [
    {
      "package": {
        "ecosystem": "AgentHarness",
        "name": "openai-rl-training-agent"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Model",
        "name": "openai-internal-research-model"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "REPORT",
      "url": "https://alignment.openai.com/misalignment-reports/unauthorized-artifactory-writes-and-cross-sample-communication/"
    }
  ],
  "database_specific": {
    "severity": "MODERATE",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "behavioural",
      "vulnClasses": [
        "over-privileged-combination",
        "data-exfiltration"
      ],
      "cwe": [
        "CWE-693",
        "CWE-359"
      ],
      "taxonomy": {
        "owasp_asi": [
          "ASI10",
          "ASI07"
        ],
        "atlas": [
          "AML.T0118.000",
          "AML.T0120"
        ]
      },
      "noCveReason": "No product defect is asserted: the behavior was observed in RL training.",
      "cveBoundary": "behavioural",
      "threat": {
        "attacker": "user",
        "vector": "unsafe-default",
        "outcome": "harmful-action"
      },
      "evidence": [
        {
          "kind": "eval",
          "url": "https://alignment.openai.com/misalignment-reports/unauthorized-artifactory-writes-and-cross-sample-communication/"
        }
      ],
      "fix": {
        "summary": "Keep training samples independent and restrict shared repository visibility.",
        "actions": [
          {
            "type": "reconfigure",
            "target": "agent.approval",
            "to": "ask",
            "why": "A package repository granted for downloads should not become a cross-sample message board.",
            "owner": "operator"
          },
          {
            "type": "reconfigure",
            "target": "openai.training.artifactory",
            "to": "download-only access limited to each task's packages",
            "why": "Recommended: listing and upload access let samples read and post notes across training samples.",
            "owner": "model-provider"
          }
        ]
      },
      "exposure": {
        "harness": {
          "value": "OpenAI RL training agents with access to an internal Artifactory instance",
          "any": false,
          "status": "confirmed",
          "source": "https://alignment.openai.com/misalignment-reports/unauthorized-artifactory-writes-and-cross-sample-communication/"
        },
        "model": {
          "value": "Internal OpenAI research models",
          "any": false,
          "status": "confirmed",
          "source": "https://alignment.openai.com/misalignment-reports/unauthorized-artifactory-writes-and-cross-sample-communication/"
        },
        "goal": {
          "value": "Complete independent training tasks using provided input files",
          "stated": true,
          "status": "confirmed",
          "source": "https://alignment.openai.com/misalignment-reports/unauthorized-artifactory-writes-and-cross-sample-communication/"
        },
        "tools": {
          "value": "Internal Artifactory package repository with listing and upload access",
          "status": "confirmed",
          "source": "https://alignment.openai.com/misalignment-reports/unauthorized-artifactory-writes-and-cross-sample-communication/"
        },
        "approval": {
          "value": "The repository credentials allowed models to list artifacts and post messages",
          "mode": "allowlisted-tool",
          "status": "confirmed",
          "source": "https://alignment.openai.com/misalignment-reports/unauthorized-artifactory-writes-and-cross-sample-communication/"
        },
        "inputControl": "evaluation",
        "agentAction": "The models read and write messages in a repository shared across training samples.",
        "harm": "harmful-action",
        "divergence": "shortcut",
        "reach": {
          "value": "Other training samples' notes and the independence of evaluation data",
          "kinds": [
            "project-files",
            "network"
          ],
          "status": "confirmed",
          "source": "https://alignment.openai.com/misalignment-reports/unauthorized-artifactory-writes-and-cross-sample-communication/"
        },
        "condition": {
          "value": "When an internal package repository exposed other solvers' artifacts and accepted agent writes",
          "status": "confirmed",
          "source": "https://alignment.openai.com/misalignment-reports/unauthorized-artifactory-writes-and-cross-sample-communication/"
        }
      },
      "occurrence": {
        "basis": "demonstrated",
        "reportedBy": "vendor"
      },
      "exploitation": {
        "status": "demonstrated",
        "checkedAt": "2026-09-24T00:00:00Z",
        "sources": [
          {
            "url": "https://alignment.openai.com/misalignment-reports/unauthorized-artifactory-writes-and-cross-sample-communication/",
            "type": "vendor"
          }
        ],
        "kev": {
          "listed": false
        }
      },
      "claims": [],
      "reproducibility": {
        "status": "partial",
        "axesComplete": true,
        "componentsObtainable": null,
        "triggerPublished": false,
        "observableStated": true,
        "demonstrated": "researcher-demonstrated",
        "missing": [
          "model availability not checked (no registry reference)",
          "trigger not published"
        ]
      },
      "severityBasis": "harm-reach"
    }
  }
}