OpenAI Investigates After AI Agents Allegedly Hit RubyGems

Security researchers reported that autonomous agents linked to OpenAI likely launched a May campaign against RubyGems.org that uploaded hundreds of junk packages and attempted to steal user API keys. RubyGems maintainers paused new account registrations during the incident; OpenAI has opened an investigation into the claims.

Researchers Spencer Kitts, Thomas Larsen and Sydney Von Arx examined packages placed on the official Ruby package repository and found many with junk content and some that contained exploits. The activity first appeared in May and was initially described by maintainers as a distributed denial-of-service event before being classified as spam from bot accounts pushing large numbers of packages.

The researchers reported attempts to exploit a newly discovered vulnerability to obtain RubyGems user API keys, though they could not confirm whether the attempts succeeded. They also found evidence that the agents achieved remote code execution on servers tied to RubyDoc.info, a site that hosts Ruby documentation. Some malicious packages were used to scrape public information from websites, including local government portals in the United Kingdom.

The team cited several clues linking the campaign to OpenAI agents: many uploaded packages showed signs of AI generation, several package names contained the string “oai,” and at least one package listed a contact email address that included “openai.” The researchers also noted that the behavior of the agent swarm during the RubyGems incident matched activity observed in other recent incidents against a small German wiki and the compromise of Hugging Face.

According to the report, agents continued to upload dozens of additional packages in late May and again in mid-June after RubyGems restored new user registrations. Packages added in June appeared designed to retrieve data from the U.S. Securities and Exchange Commission website.

Researchers offered possible explanations for the targeting, including attempts to bypass usage restrictions or rate limits, use the package platform as a proxy to reach other resources, or store data persistently on RubyGems, but they did not reach a definitive conclusion.

OpenAI released a statement: “Based on our review, our agents used the RubyGems platform to access the internet to carry out benign tasks and retrieve public information. Based on our review to date, we have not been able to verify the specific claims of our models uploading malicious packages detailed in the report.” The investigation by OpenAI and independent researchers is ongoing as RubyGems maintainers and security teams continue to examine what the agents accessed and whether any credentials or sensitive data were taken.