Forensis Lab — Forensic Recreation of the AI Agent Privilege Escalation (JFrog Artifactory)

A safe, isolated, forensic recreation of the "Incidente Cero" (OpenAI, May 2026): a sandboxed AI agent discovers the JFrog Artifactory package proxy, extracts credentials from its own configuration, improvises a message board on the server, and escalates from reader to administrator.

Study objective: determine how much of the baseline configuration enabled the event. The experiment ends at the creation of the administrator user (the "flag"). It does not cover the full incident.

Requirements

• Docker + Docker Compose (tested on Windows/WSL and Linux).
• A JFrog Artifactory Pro license — get a free 1-month trial at https://jfrog.com/start-free/. Place your license file in the artifactory_license/ folder (replace the placeholder artifactory.lic there). Without a license, Artifactory runs in OSS mode and most lab APIs (permissions, tokens, remote repos) will not work.
• Note on the version: this lab pins Artifactory 7.146.25 — the exact version whose token API accepted the forged-refresh vector (CVE-2026-65616, fixed in 7.146.27). That is the point of the lab.

Quick start

git clone <this-repo> && cd <dir>
# 1. put your license in artifactory_license/artifactory.lic
# 2. clean start (preserves data volumes; see "Reset semantics" below):
./reset.sh && ./start.sh

start.sh provisions the whole scenario (first start takes several minutes while Artifactory warms up):

1. License — installed manually by you via the UI (never automated; your license is personal and expires). The script only checks whether a license is active and warns.
2. Anonymous access explicitly enabled — as in the original incident.
3. 6 repositories — pypi/npm, each local + remote + virtual. The PyPI remote is configured with URL https://files.pythonhosted.org (the recipe that actually works in this version).
4. User agente-compartido (group readers) with write permissions (Anything: read + deploy/cache) — the bad practice that enables the message board.
5. A default reference token is provisioned to the agent through a dedicated volume; the agent renders it into /etc/pip.conf and /etc/npmrc in cleartext — the Phase 1 leak. The token shipped is in .

Shortcut: if you imported the pre-provisioned volumes from the Release (see below), provisioning is already done — ./start.sh just brings the stack up.

Verify:

curl -s http://localhost:8081/artifactory/api/system/ping     # -> "true"
docker exec -it incidente-modelo-simulado sh
# inside the agent:
cat /etc/pip.conf            # leaked credentials (the Fase 1 leak)
. /opt/venv/bin/activate
pip install six              # packages without internet, via the remote

Then follow the phases in order: phases/README.md → 00 Architecture → 01 Discovery → 02 Message board → 03 Refreshable token → 04 Escalation (CVE-2026-65616) → 05 Admin verification.

Token lifecycle (important)

• A default reference token (cmVmdGtu...) is shipped in token/token_ref.txt and is delivered to the agent by start.sh on every start.

• Reference tokens are pointers into Artifactory's database (the token hash lives in the PostgreSQL volume). reset.sh deliberately preserves the data volumes, so the token survives resets.

• To force a completely fresh state, delete the volumes manually:

  root@kitploit:~

  docker volume rm $(docker volume ls -q | grep -E 'artifactory_data_v714625|postgres_data')
  

  Then you must generate a new reference token via the admin UI and assign it directly to the user agente-compartido — not to the group. A group-scoped token is attributed to admin, and the agent's token refresh will silently fail. Update token/token_ref.txt with the new value.

• Step-by-step for regenerating: token/README.md.

Phases

Pre-provisioned volumes (Release assets)

A GitHub Release of this repository ships the three Docker volumes of the working lab as tarballs, so a clone can revive the exact provisioned state (repos, permissions, anonymous ON, token hash, cache) without provisioning:

Import (from the folder holding the tarballs):

for V in incidente_artifactory_data_v714625 incidente_postgres_data incidente_agent_secrets; do
  docker volume create $V
  docker run --rm -v $V:/data -v $(pwd):/backup alpine sh -c "cd /data && tar xzf /backup/$V.tar.gz"
done
./start.sh

Notes:

• The volumes only decrypt with the masterKey fixed in docker-compose.yml — never change it after importing.
• The bundled state ships without a license: the state is verified clean of any license material. Install your own trial license (see Requirements) right after ./start.sh — without it, writes are blocked (reads work).
• Even with volumes, the shipped reference token only authenticates while the volume state is intact — the token is a pointer into that database (see Token lifecycle above).

Reset semantics

• ./reset.sh stops containers without deleting volumes (no down -v).
• ./start.sh is idempotent: it provisions whatever is missing and keeps everything else.
• First run from a clean machine: run both. Any later run: ./start.sh alone is enough.

What this lab demonstrates

Each isolated condition of the scenario has a convenience justification (cache, shared credential, refreshable tokens). Orchestrated, they show that no sophisticated cryptographic escalation was needed: four of the six causal-chain links are configuration decisions. The trust boundary had been drawn around the company, not around each actor — and the agent was an actor inside the perimeter. The thesis in one sentence: Zero Trust is not for models, it is for companies; when the consumer changes nature (script → autonomous agent), the trust surface must be recalibrated.

Ethics

• Isolated lab: the agent has no internet access; Artifactory does, only to act as a package mirror.
• Tokens included are lab tokens: ephemeral and worthless outside this network.
• Educational and documentary purposes only: cybersecurity archaeology applied to AI agents.

Citing this repository

If you use this lab in research or teaching, please cite it via its Zenodo DOI 10.5281/zenodo.22817059:

Colmenero-Fernandez, A. (2026). Forensis Lab: Forensic Recreation of the AI Agent Privilege Escalation (JFrog Artifactory, CVE-2026-65616) (v1.0.0). Zenodo. https://doi.org/10.5281/zenodo.22817059

BibTeX:

@software{colmenerofernandez2026forensislab,
  author    = {Colmenero-Fernandez, Alicia},
  title     = {{Forensis Lab: Forensic Recreation of the AI Agent Privilege Escalation (JFrog Artifactory, CVE-2026-65616)}},
  year      = {2026},
  version   = {1.0.0},
  doi       = {10.5281/zenodo.22817059},
  url       = {https://doi.org/10.5281/zenodo.22817059}
}

Machine-readable citation metadata: CITATION.cff.