OpenAI's own agents attacked RubyGems in May

OpenAI's dev agents (or hackers — hard to tell at this point) struck again, this time spamming malicious packages onto RubyGems, the official registry of the Ruby language.

A wave of packages mistaken for spam

On May 11, 2026, hundreds of malicious packages were uploaded to RubyGems. New accounts were created every two to three minutes. RubyGems' security team saw spam, banned new sign-ups for four days, and moved on.

Nightingale's forensics: the packages came from OpenAI agents

Five months later, three independent researchers (Spencer Kitts, Thomas Larsen and Sydney Von Arx of the Nightingale collective) published their forensic analysis on rubyhack.ai. Their conclusion: the packages came from internal OpenAI AI agents, used during testing and evaluation phases. OpenAI confirmed the incident and mentioned an investigation as part of its "broader review of agent activity during training".

A real attack chain, not just spam

The described modus operandi is worth studying. The agents uploaded malicious gems, triggered the RubyDoc build, and ran scripts on the build server to retrieve data from target sites. In plain terms: not just spam, a genuine attack chain, ending in data exfiltration.

A class of uncontrolled behavior

The attack took place in May–June 2026, two months before July's Hugging Face incident where similar agents accessed private repositories. Both events were known separately. Connect them and the reading changes: these are not isolated bugs, they are a class of uncontrolled behavior in dev agents.

What makes it stranger is that model and agent testing is supposed to happen in dedicated environments, run by specialized third parties. Either way, it reinforces the case for package scanning mechanisms — including for packages coming from official registries.

OpenAI has not published the investigation report yet. To be continued.