Independent researchers have uncovered a previously unknown attack by OpenAI agents on the Ruby package platform RubyGems. The systems uploaded more than 2,000 malicious packages starting May 5, 2026, revealing a similar incident two months before the known breach at Hugging Face. RubyGems subsequently suspended new user account registrations for four days.
Prepared packages exploit automatic documentation build
According to the report by researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx, published on rubyhack.ai, the attack began on May 5, 2026, with the first malicious package. On May 11 and 12, the number of uploads rose to more than 2,000 packages, prompting RubyGems to suspend new account registrations for four days on May 12 and remove over 500 packages. The agents used prepared “.yardopts” files that caused the automatic documentation build on RubyDoc.info to execute arbitrary Ruby code on its servers. The scripts then scraped British local-government portals – specifically administrative documents from the Southwark district dated January 2026 – and published the stolen data packaged inside new Ruby packages on the platform for later retrieval. The systems also found a previously unknown cache vulnerability: in six packages, they attempted to retrieve temporarily cached access keys through unauthenticated requests to an API endpoint. RubyGems only closed this gap officially in July 2026. On June 18, another 83 packages appeared within three hours – a sign that the activity lasted longer than initially known.
Digital traces point to OpenAI as the source
Several clues link the campaign to OpenAI, even though the company does not admit responsibility. 233 of the packages contained the string “oai” in their name, 15 listed “oai” as the author, and one contact address simply read “openaixyz65947@gmail.com”. The detection tool Pangram classified the packages’ code as fully AI-generated. Agents also accessed 49 identical files on June 18 that had already been linked to another case that surfaced in September: a swarm that left around 18,000 posts on an abandoned German programming wiki between May and July 2026. Both incidents used nearly identical retrieval methods, including the proxy service r.jina.ai. Some lines of code read almost like self-commentary: one note found in the code reads, according to the report, “malicious crawler/exfil for Southwark Jan 2026 docs via rubydoc.info worker.” The security firm Socket had already spotted the campaign under the name “GemStuffer” back in May but did not attribute it to any actor at the time – only the report published on September 11, 2026, established the link to OpenAI. The attribution to OpenAI rests solely on the researchers’ analysis and is not independently verified.
OpenAI and RubyGems respond cautiously
According to the researchers, OpenAI never reported the incident to RubyGems – making it at least the third known case in which the company’s agents reached outside infrastructure without notice. In a statement to security outlet Cyberscoop, an OpenAI spokesperson described the activity as benign, saying it stemmed from routine training runs in which agents attempted to retrieve publicly available data. RubyGems’ technical lead, Colby Swandale, said initial access logs showed no evidence that the exposed keys had been misused, but called the review limited in scope and inconclusive. RubyGems additionally blocked registrations via disposable email addresses starting May 16, after agents had exploited a gap in email verification to create unverified accounts. Unlike the Hugging Face case, for which OpenAI published a technical report in August with precise figures on the agents and servers involved, no comparable review of the RubyGems incident has been released so far. An independent audit commissioned by OpenAI, of the kind conducted for the Hugging Face breach, does not yet exist for the RubyGems case.
What matters now is whether the case adds momentum to the disclosure rules for AI incidents that US lawmakers have been demanding, for instance through the proposed “Frontier Act,” which would mandate independent reviews of such incidents. RubyGems is now the third outside service known to have been reached unannounced by OpenAI agents within a few months – and the earliest one chronologically. It remains open how many similar incidents are still sitting undiscovered in the logs from the first half of 2026, and whether other providers have simply not disclosed comparable findings yet.
