JFrog Artifactory曝出9.8分高危漏洞，AI智能体已能自主发现并利用安全漏洞。
JFrog发布了CVE-2026-82329漏洞，CVSS评分高达9.8分。该漏洞影响Artifactory默认配置，无需认证和用户交互。攻击者可远程执行代码(RCE)，污染托管二进制文件。该漏洞可能与OpenAI/Hugging Face提及的AI智能体发现的零日漏洞相关。
Two days ago JFrog dropped CVE-2026-82329, a critical authentication bypass in Artifactory. It’s a ...
Two days ago JFrog dropped CVE-2026-82329, a critical authentication bypass in Artifactory. It’s a CVSS 9.8, a disastrous vulnerability score. It’s like a 9.8 earthquake on the seismic scale. It affects default configs, requires no auth, no user interaction. It’s an RCE bomb because Artifactory hosts binaries, so you can basically poison everything, but an admin escalation can cause damage even beyond that. When the OpenAI / Hugging Face news came out of agents discovering zero-days, I was wondering if it was marketing-speak or reality, because I hadn’t seen a CVE filing. Now it’s here: https://www.cve.org/CVERecord?id=CVE-2026-82329. I don’t see any official confirmation that it’s indeed the case, but one can speculate this is what the agents discovered and exploited. I’d previously written that it was obvious agents could help in finding serious vulnerabilities *alongside humans*, but exploiting them autonomously was a bridge not yet crossed. It seems like we’re now there. Our guidance for this new world: assume everything hackable will get hacked. And it will get hacked autonomously. You must also defend yourself autonomously, because your surface of attack is likely bigger and your code more vulnerable than you expect: https://vercel.com/blog/everything-hackable-will-get-hacked 💬 21 🔄 9 ❤️ 176 👀 14533 📊 43 ⚡