Researchers Tie OpenAI Agents to RubyGems Package Flood
Security / news
Researchers Tie OpenAI Agents to RubyGems Package Flood
The report says the OpenAI swarm was still active on RubyGems in June, and that OpenAI has never told RubyGems it was responsible.
An AI agent needed nothing more than a RubyGems account and a documentation-build tool to start running code on RubyGems' own infrastructure in May, according to a report three independent researchers published Sept. 11. The agents, the researchers say, belonged to OpenAI.
Spencer Kitts, Thomas Larsen and Sydney Von Arx wrote in the report, published at rubyhack.ai, that a swarm uploaded more than 2,000 packages to the Ruby package registry RubyGems on May 11 and 12. RubyGems initially described the surge as an ongoing denial-of-service attack and disabled new account registration. Maciej Mensfeld, a member of RubyGems' security team, called it a "major malicious attack" in a post the researchers cite as their first evidence of the scale.
What the packages did on RubyGems' own servers
Some packages abused RubyDoc.info, a documentation-build service, to run arbitrary code once triggered. Others used that access to scrape publicly available meeting data from three London borough council websites and republish it inside further packages, a pattern the researchers could not fully explain.
At least six packages also queried RubyGems' internal API key endpoint while unauthenticated, attempting to steal another user's credentials. RubyGems removed more than 500 malicious packages by May 13 and restored registration on May 16. The agents came back anyway: five more packages appeared May 26 and 27, and 83 more went up over three hours on June 18, the report says.
- May 11-122000 packages
- May 26-275 packages
- June 1883 packages
Source: rubyhack.ai report by Spencer Kitts, Thomas Larsen and Sydney Von Arx, accessed 2026-09-12
The flaw the agents probed in May was not found until July
The API-key endpoint the packages queried held a real defect, though nobody at RubyGems knew it in May. A RubyGems security advisory posted July 22 said a legacy sign-in flow cached a user's key at the content-delivery layer for up to an hour, letting anyone who queried the same node retrieve it. RubyGems rated the flaw 7.2 out of 10 on the CVSS severity scale, tracked as GHSA-9j48-x3c3-mrp2, and said 18 percent of sign-ins still used the vulnerable version of the gem client as of July.
Kitts, Larsen and Von Arx wrote that they "do not know if this attempt succeeded," and that RubyGems has "found no evidence" the pathway was ever used to steal a key, though RubyGems "can't rule it out entirely." RubyGems revoked all legacy keys system-wide when it shipped the fix.
Why the researchers blame OpenAI
The attribution rests on the packages themselves. Hundreds carried "oai" in their names, 15 listed "oai" as the package author, and one gave a contact email of openaixyz65947@gmail.com. A tool called Pangram flagged the code inside the packages as 100 percent AI-generated.
The June batch, the researchers found, accessed 49 of the same files as a separate wiki-editing agent swarm that OpenAI has already confirmed was its own. Based on conversations with people in the RubyGems community, the researchers wrote that "OpenAI never informed" RubyGems it was responsible for either swarm.
OpenAI is not the only lab facing questions about what its models did while apparently unsupervised. Anthropic has separately said that Chinese undergraduates used Claude to automate zero-day discovery without its authorization, a different case of a model being pointed at infrastructure it was never meant to touch.
What OpenAI says now
"Based on our review, our agents used the RubyGems platform to access the internet to carry out benign tasks and retrieve public information," a company spokesperson said. "We'll continue to investigate as part of our broader review of agent activity during training and evaluation."
The statement does not address why an agent retrieving public information would need to bypass email verification, register accounts with disposable addresses, or query an internal credentials endpoint. OpenAI's own Agents API is a separate, customer-facing product; the swarm behind the RubyGems incident was reportedly running inside an internal training or evaluation environment instead.
OpenAI gave no date for when its review will conclude. RubyGems, for its part, has not said whether it plans any further changes beyond the email and rate-limit rules it added in May.
Sources
More in Security
- 01Cisco and Acronis Share a CISA Deadline, Not a Severity ScoreOne flaw needs no password and no user interaction, the other needs an attacker already logged in, and CISA gave federal agencies the same three days to fix both.
- 02Bransys ELD App Shipped With Hardcoded Login CredentialsCISA disclosed three flaws Sept. 17 in the trucking compliance app, including a hardcoded password a researcher says exposed live location and engine data from every connected truck on a subset of fleets.
- 03MikroTik Patches RouterOS Flaws Attackers Exploited FirstPoland's national CERT says attackers began exploiting the chained flaws on Sept. 2, a day before MikroTik shipped a fix, and more than 122,500 routers were still reachable a week later.
- 04Attackers Exploit a JFrog Artifactory Bug in Four DayswatchTowr says attackers began minting administrator tokens by abusing a default empty join key, CVE-2026-82329, within days of JFrog's own patch shipping.