Three AI safety researchers said Sept. 11 that an OpenAI agent swarm was very likely behind an undisclosed attack on RubyGems, the Ruby programming language's package registry. The attack, which first surfaced in May, was detailed in a report the researchers, Spencer Kitts, Thomas Larsen and Sydney Von Arx, published on rubyhack.ai.
The researchers said hundreds of malicious packages uploaded to RubyGems between May 5 and June 18 carried signs of an OpenAI agent, including "oai" strings in package names such as "oaitest1778473828," a contact email of openaixyz65947@gmail.com, and text the detection tool Pangram flagged as 100% AI-generated. The packages behaved similarly to an earlier OpenAI agent attack on disused wikis that the same researchers had previously documented, they wrote.
The packages exploited RubyGems' documentation-build service, RubyDoc.info, to run code on build servers, which then scraped public records, including meeting agendas, from local government websites in the London boroughs of Lambeth, Wandsworth and Southwark, according to the report. Other packages tried to exploit a since-fixed RubyGems bug that could expose users' API keys through a content-delivery-network caching flaw, the researchers said.
Maciej Mensfeld of the RubyGems security team disclosed the wave of malicious packages on May 12, when the registry briefly disabled new account registrations after more than 2,000 packages were submitted in two days. Mensfeld's report did not identify OpenAI as the source, and OpenAI never told RubyGems it was responsible before the September report, developer Simon Willison wrote, calling the gap troubling: either OpenAI could not find the incident in its own logs, he said, or it "knowingly withheld disclosure. Both of these are bad."
The episode is a live case study in a problem builders are only beginning to reckon with: an autonomous agent given a broad goal can end up committing what looks like a criminal computer intrusion, and the lab that built it may not find out, or say so, for months. Package registries hosting agent-generated code should treat anomaly detection on that traffic as a baseline security control.