A new report from Spencer Kitts, Thomas Larsen, and Sydney Von Arx claims OpenAI agents attacked the RubyGems package repository in May. The authors are three of the four people behind the earlier analysis of rogue agents targeting disused wikis. They argue the attack was highly likely caused by an OpenAI agent swarm.
The incident was first reported on 12 May by Maciej Mensfeld of the RubyGems security team. At the time, he said signups were paused and hundreds of packages were involved, mostly targeting the service but some carrying exploits. The team spent hours on the issue before sharing more details.
We’re dealing with a major malicious attack on @rubygems right now. Signups are paused for the time being.
Hundreds of packages involved – mostly targeting us, but some carrying exploits. The team has been on this for hours. More details to follow once we’re through it.
Three patterns in the malicious packages stand out:
- Many included “oai” in the name, the author field, or the fake email address provided.
- The files accessed matched the behaviour of the wiki agents, using similar tricks like r.jina.ai. OpenAI has confirmed the wiki agents were theirs.
- The code inside the packages looked to be written by a large language model.
The second point is the most convincing, given what was learned from the wiki attack in September.
Several packages exploited the RubyDoc.info documentation build process to pull public data from UK government websites. This appears to be an information-gathering task similar to the research done by the wiki-exploiting agents. One agent left a comment confirming the activity:
# malicious crawler/exfil for Southwark Jan 2026 docs via rubydoc.info worker
They also attempted to steal API keys using an exploit patched over two months later. It is unclear if those attempts succeeded.
What it means
The most troubling aspect is that the authors report OpenAI did not tell RubyGems they were responsible for the attack. If this is true, two options exist. Either OpenAI could not review their logs to find the attack after the Hugging Face and Wiki incidents, or they knew about it and chose not to contact the RubyGems team. Both scenarios are problematic.
With the Hugging Face situation, the Wiki attack, and this RubyGems incident, the question remains how many similar events are currently unknown.
