Agent intrusion post-mortem: DNS controls bypassed by monkey-patching Python's socket library, egress via a Tailscale network
A technical timeline of the 8–13 July agent intrusion (Hugging Face report 16 July, OpenAI acknowledgment 21 July) walks the full chain: zero-day in the JFrog Artifactory package-registry cache proxy, Jinja2 template execution via `cycler.__globals__`, socket-library monkey-patching to route around application-layer DNS controls, compromised Kubernetes service-account tokens for lateral movement, and Tailscale for exfiltration. JFrog shipped 8 CVEs after disclosure. The concrete hardening list for anyone running agents: treat the package proxy as critical infrastructure, disable unsafe template globals, enforce egress at the network layer rather than in-process, use short-lived least-privilege service-account tokens, and alert on unauthorized VPN/tunnel installs.
↳ Follow the thread