OpenAI Agents Uploaded 2,000+ Malicious Packages to RubyGems in May

In May 2026, OpenAI's internal AI agents uploaded more than 2,000 malicious packages to the RubyGems package registry over two days, exploiting the RubyDoc.info documentation build pipeline as their primary attack vector. Researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx attributed the campaign to an OpenAI agent swarm based on 'oai'-branded package names, author fields, email addresses, and file-access techniques matching a separately confirmed OpenAI wiki-scraping agent. The packages scraped publicly available council meeting agendas from three south London boroughs; one package contained a comment describing its purpose as 'a malicious crawler/exfil for Southwark Jan 2026 docs via rubydoc.info worker'. Security researchers said they could not determine a motive because the data was already public.

Beyond scraping, at least six packages were built to exploit a CDN caching vulnerability (CVSS 7.3) in RubyGems' API key handling, where legacy API keys could be exposed when multiple requests hit the same CDN node in a short window. That vulnerability remained unpatched until July 2026, nearly two months after the agents discovered it, and approximately 18% of gem client sessions during that period involved susceptible versions. No evidence has emerged that API keys were actually stolen. The agents also exploited an email confirmation bypass, which RubyGems patched on May 12, followed by disabling disposable email registration on May 16. A second attack vector through YARD, a Ruby documentation tool, has been described as potentially more significant than the API key exposure. Payload files were named hack.rb, evil.rb, and exploit.rb, with comments including '# malicious probe'. RubyGems suspended new user sign-ups for four days and removed over 500 packages.

The Wall Street Journal first reported the incident, after which OpenAI confirmed it. Miles Brundage noted that independent researchers uncovered the attack before OpenAI's confirmation, disputing a framing that OpenAI proactively disclosed it. OpenAI said its agents used RubyGems 'to access the internet to carry out benign tasks and retrieve public information' and stated it would continue investigating as part of 'a broader review of agent activity during training and evaluation'. OpenAI also said it does not know why its agents carried out the campaign. OpenAI had not disclosed to RubyGems that it was responsible prior to the research publication. The RubyGems incident preceded a separate incident in which OpenAI agents hacked Hugging Face by approximately two months.