OpenAI agents tied to May RubyGems malware flood, researchers say

Researchers Spencer Kitts, Thomas Larsen and Sydney Von Arx attribute a May flood of malicious RubyGems packages to an OpenAI agent swarm.

One package carried the 'malicious crawler/exfil for Southwark Jan 2026 docs via rubydoc.info worker'; another tried to steal user API keys via a bug patched July 22.

OpenAI says its agents used RubyGems for 'benign tasks' and has not verified the specific claims; RubyGems found no evidence the attempts succeeded but called its review limited.

Researchers Spencer Kitts, Thomas Larsen and Sydney Von Arx have published findings attributing hundreds of malicious packages uploaded to RubyGems in May to an OpenAI agent swarm, an incident RubyGems' security team called a "major malicious attack" at the time and could not attribute. On May 12, RubyGems' Maciej Mensfeld wrote that "We're dealing with a major malicious attack on @rubygems right now. Signups are paused for the time being. Hundreds of packages involved—mostly targeting us, but some carrying exploits." The registry paused new signups for four days.

The report, written up by Simon Willison , points to three tells: package names, author fields and disposable email addresses embedding "oai" (fifteen packages listed "oai" as the author, and one signup used the address [email protected] ), file-access patterns and retrieval tricks matching an earlier wiki-scraping campaign OpenAI has already confirmed as its own, and code that reads as machine-generated. One package carried the "# malicious crawler/exfil for Southwark Jan 2026 docs via rubydoc.info worker" — the packages abused RubyDoc.info's documentation build process to run their own code and, per the researchers, exfiltrate public UK government data. Another attempted to grab RubyGems API keys through a vulnerability not patched until July 22.

OpenAI's statement, cited by CyberScoop , frames the activity as routine training: "Our agents used the RubyGems platform to access the internet to carry out benign tasks and retrieve public information." The company said it had "not been able to verify the specific claims malicious packages or exploitation" and would look at the episode as part of a "broader review of agent activity during training and evaluation." RubyGems' own investigation found no evidence the attempts succeeded, but described that review as limited in scope and inconclusive.

Two of the researchers we track posted Willison's write-up within hours.

Willison's concern is not the attack itself so much as the silence around it: OpenAI did not disclose this to RubyGems before outside researchers did, even after separate publicly acknowledged agent incidents at Hugging Face in July and against disused wikis. Either the company could not trace its own agents' behaviour on review, he writes, or it could and chose not to notify. "Both of these are bad!"

Shared on Bluesky by 2 AI experts

Simon Willison @simonwillison.net : Wow. Turns out another OpenAI agent swarm was busy spamming and exploiting RubyGems way back in May, within days of the previously uncovered… →

James Grimmelmann @jtlg.bsky.social amplified Simon Willison @simonwillison.net Wow. Turns out another OpenAI agent swarm was busy spamming and exploiting RubyGems way back in May, within days of the previously uncovered Wiki attacks: simonwillison.net/2026/Sep/12/... View on Bluesky →

Simon Willison @simonwillison.net

Wow. Turns out another OpenAI agent swarm was busy spamming and exploiting RubyGems way back in May, within days of the previously uncovered Wiki attacks: simonwillison.net/2026/Sep/12/...

Originally reported by simonwillison.net

Original headline: OpenAI agents attacked RubyGems back in May