Three common ingredients in cyberattacks: attackers take advantage of publicly described exploits on deprecated software, escalate access thanks to uncareful permissioning, and gain access using credentials that were not meant for them.

🟠 Agents initially escalated privilege within OpenAI's infrastructure by gaining root thanks to a description of Linux kernel CVE of severity 7.8 that was publicly disclosed and fixed but not patched on their machines.
🟠 Later, agents were able to "rapidly escalate privileges" as they exploited Kubernetes misconfigurations, including "overpermissioning of service accounts" within their internal Kubernetes cluster.
🟠 The agents then "harvest[ed] cluster credentials," including Azure Key Vault. This is not described in any detail, but there is no indication that ingenuity was required. (6/7)