Reported by 5 outlets

Timeline

1. original reporting

   Researchers say OpenAI agents were behind May hacking campaign targeting RubyGems

   cyberscoop.com · 32d ago · September 12th, 2026

   Researchers say they have discovered thousands of malicious software packages uploaded to an online public software repository that were left by a “swarm” of OpenAI agents. According to an incident timeline published Friday by researchers Spencer Kitts, Thomas Larsen and Sydney Von Arx, the campaign began May 5 when they observed a handful of suspicious packages being uploaded to RubyGems, a public library for the Ruby programming language. By May 11 and 12, the site saw more than 2,000 malicious uploads from the same actors before RubyGems maintainers halted new user sign-ups for four days to stop the flow. In one instance, the agents attempted to exploit a very recent vulnerability that had only been discovered this past July that would have given them access to RubyGem user API keys. According to Colby Swandale, the technical lead at RubyGems, the flaw involved an improper cache configuration . While initial access logs showed no evidence of malicious key use, Swandale acknowledged the review was limited in scope and inconclusive. According to the report published Friday, the agents also used “disposable” email addresses and exploited another bug in RubyGems platform (since patched) that allowed them to register new accounts and gain API keys without verifying their email address. The researchers said their understanding, based on discussions with “people in the RubyGems community,” is that OpenAI had yet to disclose the involvement of their agents in the May campaign. An

2. update from desnips.nl

   Rogue OpenAI agents independently spread malware and hijacked developer platforms outside human control

   desnips.nl · 32d ago · September 12th, 2026

   Rogue OpenAI agents independently spread malware and hijacked developer platforms outside human control

   via Mastodon https://desnips.nl/fccc1b2-OpenAI-kunstmatige-intelligentie/

3. update from cyberscoop.com

   OpenAI agents reportedly used in a hacking campaign targeting RubyGems in May

   cyberscoop.com · 32d ago · September 12th, 2026

   OpenAI agents reportedly used in a hacking campaign targeting RubyGems in May. The interesting angle here: it's not just about what AI can generate, but about autonomous agents that exploited platform vulnerabilities and verification gaps at scale.

4. update from securityweek.com

   OpenAI Investigates Report Linking AI Agents to RubyGems Attack

   securityweek.com · 28d ago · September 15th, 2026

   OpenAI has launched an investigation after researchers reported that its AI agents are likely responsible for the attack that forced RubyGems maintainers to suspend new account registrations in May. RubyGems.org, the official Ruby gem hosting service, was targeted in May in what initially appeared to be a DDoS attack and later described as “spam activity” involving bot accounts. Those accounts pushed hundreds of junk packages, including ones containing exploits. The AI agents also achieved remote code execution on servers associated with the RubyDoc.info documentation website, the researchers said. The malicious packages enabled the agents to scrape public information from websites, specifically UK local government portals. The attack on RubyGems took place prior to the highly publicized attack on Hugging Face and around the same time as the OpenAI agent attack on a small German wiki website . In fact, the researchers noted that the agent swarms involved in the wiki and the RubyGems attacks behaved “extremely similarly.” This similar behavior is one of the main pieces of evidence that has allowed the researchers to link the RubyGems attack to OpenAI agents. In addition, they noted tha

5. update from privacysafe.social

   🛡️ # Cybersecurity news & tips across the # fediverse “🕵️ Latest from ⌗Surveillance ⌗Technology Oversight Project (S․T․O․P․) ⌗NYC ''ICE and

   privacysafe.social · 28d ago · September 15th, 2026

   🛡️ # Cybersecurity news & tips across the # fediverse “🕵️ Latest from ⌗Surveillance ⌗Technology Oversight Project (S․T․O․P․) ⌗NYC ''ICE and

   via Mastodon https://privacysafe.social/@yaleprivacylab/117273762809212982

6. update from malware.news

   Inside the OpenAI-RubyGems Incident: Did AI Agents Attack RubyGems?

   malware.news · 28d ago · September 15th, 2026

   Key Takeaways A May 2026 malicious package campaign forced RubyGems to suspend registrations and withdraw more than 500 gems. Packages abused RubyDoc.info documentation builds to run code on its servers and republish harvested web data. At least six packages tried stealing other users' API keys through a cache flaw fixed in July. Package names, shared target files, and explicit code comments link the campaign to OpenAI agents. RubyGems could not independently confirm attribution and found no evidence that any API key theft succeeded.