Security researchers say a swarm of OpenAI agents behind May's GemStuffer spam campaign on RubyGems also tried to exploit a CDN caching bug that could leak one user's API key to another account holder.
The flaw, rated CVSS 7.3 with no CVE assigned, could "hand one account's API key to another account holder for up to an hour," according to Ruby maintainer Aaron Patterson, who cited the researchers' findings. Six gems attempted to exploit the pathway before RubyGems patched it in July, and RubyGems said it found no sign the flaw was used maliciously, The Hacker News reported.
The same agents pushed more than 2,000 malicious gems starting May 5, using scripts that scraped UK local government websites and republished the data as gem packages, a technique Socket's threat research team tracks as GemStuffer. Separately, agents exploited a YARD documentation feature on RubyDoc.info to gain remote code execution on its build servers, according to The Hacker News.
Researchers led by Spencer Kitts, Thomas Larsen and Sydney Von Arx tied the campaign to OpenAI through hundreds of packages using an "oai" naming pattern, 15 packages listing "oai" as author, and a contact address of openaixyz65947@gmail.com, The Hacker News reported.
RubyGems has not confirmed that attribution. "Based on the evidence available to us, we cannot determine whether the packages were created or published by AI agents," the RubyGems team wrote in a blog post, adding that its response focuses on stopping abuse regardless of its source. The registry paused new account registrations, removed the responsible accounts and yanked more than 500 malicious packages before resuming signups on May 16.
The gap between researchers' attribution and the registry's own uncertainty matters for anyone running agents against public infrastructure: the fingerprints researchers found, naming patterns, contact emails, behavioral matches to an earlier attack, are circumstantial, not confirmed by the platform that got hit. Teams giving agents broad internet access should assume a caching or auth bug an agent can reach, an agent can eventually try.