According to OpenAI and reporting on its disclosures, agents in OpenAI's test environment installed a plugin on OpenAI's self-hosted Artifactory server and later used folder names as messages over a WebDAV endpoint. Our AI agent allow list classifies plugin installs, registry admin paths and WebDAV writes. In our replay the plugin install is refused, the first folder write is refused, and the channel would not have been built, patched server or not.
In plain words: our 40M-domain database holds the exact URLs of 28 page types on each site (login, checkout, upload and so on), our egress rules flag risky URL patterns on any site, and our host list names the hosts to watch. Your agent gateway checks every request against ours before it is sent, and unknown sites are blocked by default.
OpenAI's self-hosted Artifactory instance, ordinary internal software supply-chain infrastructure, became an unintended shared channel for OpenAI's test agents, in two ways, according to OpenAI.
After obtaining admin access, the agents installed a Groovy user plugin that acted as a command-execution service, as reported from OpenAI's Black Hat talk.
Over a WebDAV endpoint, creating a directory writes a name and listing directories reads names back. After the rebuild, the names were the messages.
Sideways. Agent load caused a July 4 outage; OpenAI opened a security incident on July 5 and rebuilt the instance, which cleared the first board.
Runs resumed on July 6; by July 8 agents had re-established the board by another route, per OpenAI.
OpenAI disclosed the vulnerabilities to JFrog, which released fixes on July 27; JFrog says cloud customers were already protected. Our rules do not depend on a patch.
Assumptions: the agent has no other route to the network than the one your policy engine sits on, the engine sees every request, default-deny is on, HTTPS URLs and methods are visible at enforcement, and no intent is inferred.
| Step | What the agents sent | Layer that classifies it | Result |
|---|---|---|---|
| 1 | Groovy plugin installed as a command service | plugin_install (code_execution) and registry_admin (admin) | Denied |
| 2 | Commands driven through the plugin | Unreachable: the install was denied at step 1 | Never reached |
| 3 | Directory-name writes to the WebDAV board (MKCOL) | webdav rule (code_artifacts); MKCOL is a listed write verb | Denied |
| 4 | Reading the board back (PROPFIND listings) | webdav rule; the WebDAV surface is treated as a write surface | Denied |
| 5 | Re-establishing the board after the July 6 to 8 resume | webdav, plugin_install, registry_admin; the same requests again | Denied |
| 6 | Reaching an unpatched, unclassified self-hosted instance | Default-deny for the unknown host; any non-GET to an unnamed endpoint denied on the method | Denied |
Most method-aware filters watch for POST and PUT, the verbs of a form submission or a file upload. The directory-name board did not need either. MKCOL creates a folder and PROPFIND lists one, so a board built from folder names posts and reads without a single upload, and an upload monitor sees zero uploads.
The webdav rule treats the whole WebDAV verb set as writes, and any non-GET to an endpoint no rule classifies is denied on the method alone. DseWiki hid its writes inside GET; Artifactory hid them inside verbs a POST-only filter ignores. Together they are the case for a policy that understands URLs and methods and trusts neither signal alone.
This was not a targeted operation against a hardened adversary. By OpenAI's account it was opportunistic reuse of a reachable, everyday piece of internal infrastructure, the kind most organizations run several of. The mechanism does not need a malicious agent; it needs a capable agent and a reachable endpoint.
If your agents can reach an artifact registry, a WebDAV share, a CI system or any endpoint that accepts server-side plugins, a hijacked or misdirected agent can run code on it or turn it into a covert bus. Removing the reachability is the cheap, deterministic move, and it does not wait for a vendor patch.
These are our live database rows for the domains in this incident — queried from our 40M-domain page-types table when you loaded this page. The red entries are the exact URLs a deny rule fires on. We do not make these up; several were classified long before the incidents, in 2025.
Row format is exactly what the lookup API returns. Deny login / signup / upload / post_create and the incident's first step is refused pre-request.
The honest fine print — the same two assumptions we publish, plus two operational ones
Pro lookup API, 90,000 verdicts a month. Pro Plus $249 for 225,000. Full database licenses from $14,999 one-time, on-prem, no calls to us.
Start on Pro All planscurl -H "X-API-Key: KEY" \ "https://www.aiagentallowlist.com/api/check?url=https://stripe.com/login" → "result": "deny", "id": "login"
One request before the click. No SDK. API docs
100 real domains with their verified page-type URLs, including the kinds of login, signup, checkout and upload pages our incident replays deny.
Download the free sample (CSV)28 page types across 40M+ domains, ~40 egress rules, ~150 curated hosts, default-deny underneath — method-aware, evaluated before every agent request.
