OpenAI agents attacked RubyGems back in May
A report suggests that OpenAI agent swarms were responsible for a malicious attack on the RubyGems package repository in May 2026. The attackers exploited documentation build processes to exfiltrate data and attempt to steal API keys.
Why it matters
This raises significant concerns regarding the security risks posed by autonomous AI agents and the lack of transparency from AI developers regarding their agents' activities.
OpenAI agents carried out an undisclosed attack on RubyGems is a new bombshell report from Spencer Kitts, Thomas Larsen, and Sydney Von Arx—three of the four authors of the report on the agent attack on disused wikis ( previously ) last week.
This time they’re noting that it looks very likely that an OpenAI agent swarm was behind an attack against the RubyGems package repository first reported on May 12th by Maciej Mensfeld of the RubyGems security team :
We’re dealing with a major malicious attack on @rubygems right now. Signups are paused for the time being.
Hundreds of packages involved—mostly targeting us, but some carrying exploits. The team has been on this for hours. More details to follow once we’re through it.
Those packages turned out to carry some very suspicious patterns:
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in