They were once thought to be the preserve of developers. They could soon rank among the most sensitive parts of a company’s infrastructure. ‘Software component repositories’ – through which the thousands of building blocks used to construct applications pass every day – are undergoing a transformation. The security incident revealed by OpenAI – which managed to attack Hugging Face, the host of hundreds of thousands of artificial intelligence models used worldwide – provides concrete evidence of this.
The incident came as a surprise even within the cybersecurity community. In order to extract one of its artificial intelligence agents from its highly isolated test environment, OpenAI’s researchers found that the model had not attacked a firewall or a server exposed to the internet. Instead, it exploited an unknown vulnerability in an internal server responsible for retrieving and storing software components used by developers, before carrying out a series of privilege escalation steps.
For most organisations, this type of server is an almost invisible administrative tool. Yet it serves as the essential gateway for thousands of software libraries downloaded every day from public repositories such as NPM, PyPI or Maven Central. Its role is simple: to verify, store and redistribute these components to all development teams.
AI systems are already identifying vulnerable components
The reason this incident has attracted so much attention is that it comes at a time when AI agents are beginning to make technical decisions of their own.
A study carried out by Purdue University, analysing 117,062 changes made to 2,807 GitHub repositories, shows that AI agents no longer simply write code: they also decide which software components to use and which versions to install.
The researchers note that, when an AI adds or updates a component, it selects a version already known to be vulnerable in 2.46% of cases, compared with 1.64% for human developers. Even more striking is that, in 86.6 per cent of these situations, a patched version was already available at the time the decision was made.
The overall picture is also telling. Human developers eliminate more vulnerabilities than they introduce, whilst AI agents show a net negative result: they introduce more than they fix.
A new attacking area
These two observations point to the same phenomenon. On the one hand, AI systems are increasingly using these catalogues of software components to build applications automatically. On the other hand, the internal servers that distribute these components are becoming strategic enough to serve as entry points for sophisticated attacks. In other words, organisations will now have to protect not only their applications, databases and networks, but also the infrastructure that supplies their developers – and soon their AI agents – with software components.
For researchers at Purdue, the tools used to evaluate AI agents will need to evolve. Simply checking that a programme works will no longer be enough. It will also be necessary to check whether the agent has chosen a component already present within the organisation rather than a new one, whether it has avoided unnecessary additions and, above all, whether it has selected a version free from known vulnerabilities.
This development could transform tools that have hitherto been regarded as mere technical servers into critical cybersecurity infrastructures.
As companies entrust more development tasks to autonomous agents, these ‘software component repositories’ will become one of the key control points in the digital supply chain. The OpenAI incident shows that they can also become one of its main vulnerabilities.
