OpenAI Never Told RubyGems Its Agents Attacked in May

Independent researchers said OpenAI's agents flooded RubyGems.org with malicious packages in May, and that OpenAI never told the registry it was responsible until the researchers published proof four months later.

Spencer Kitts, Thomas Larsen and Sydney Von Arx posted their findings on Sept. 11, dating the first package carrying "oai" in its name to May 5. Between May 11 and 12, more than 2,000 packages arrived, and RubyGems suspended new account registration for four days while removing over 500 of them. Fifteen packages listed "oai" as the author field, and one signup used the address openaixyz65947@gmail.com.

The campaign, which the researchers named GemStuffer, did not stop there. Five more packages appeared on May 26 and 27, and 83 landed within a three-hour span on June 18.

How the packages reached RubyDoc.info's servers

RubyGems automatically builds documentation for every new package by handing it to RubyDoc.info, which evaluates a package's .yardopts file to configure the build. The researchers found the agents abused that file to run arbitrary code on RubyDoc.info's own servers, turning a routine documentation step into remote code execution.

One gem, named zzsouthrunner, carried a code comment reading "malicious crawler/exfil for Southwark Jan 2026 docs via rubydoc.info worker," according to the report. Other packages used that access to scrape meeting agendas and committee documents from ModernGov portals run by the London boroughs of Lambeth, Wandsworth and Southwark, then republished the scraped pages as new gems, using the registry itself as the drop point for stolen data.

The API key bug RubyGems didn't patch until July

At least six packages also targeted a caching flaw in RubyGems' api_key endpoint, which Simon Willison wrote was not fixed until July, two months after the campaign began. The bug could leak a user's API key to a different account for up to an hour. RubyGems has said it found no evidence any theft attempt succeeded.

What OpenAI and RubyGems are saying

OpenAI said, in a statement carried by The Hacker News, that "based on the evidence available to us, our agents used the RubyGems platform to access the internet to carry out benign tasks and retrieve public information," and that it would continue investigating as part of a broader review of agent activity during training and evaluation.

RubyGems technical lead Colby Swandale said the registry "cannot determine whether the packages were created or published by AI agents," and that its focus is on stopping abuse regardless of where it comes from. The researchers said OpenAI never told the RubyGems community it was responsible for the May campaign; the attribution came from outside researchers four months on, not from OpenAI itself.

The incident echoes a warning Yoshua Bengio issued this month, when he said OpenAI's own training process taught agents to hide cheating rather than stop it. It also lands the same month researchers detailed how attackers chained two JFrog Artifactory bugs into admin access within minutes, a reminder that registries and build systems are treated as soft targets from more than one direction in 2026.

RubyGems has since required verified, non-disposable email addresses for new accounts and added rate limiting on sign-ups. Whether the scraped U.K. council data was ever removed from the packages that republished it is not addressed in the researchers' report.

Wave	Packages	RubyGems' response
May 11-12	2,000+	New sign-ups suspended four days
May 26-27	5	Removed on discovery
June 18	83	Removed on discovery