OpenAI test agents uploaded hundreds of malicious packages to RubyGems, researchers say
nordicinst · x · 2026-09-12
A group of AI researchers says hundreds of malicious packages uploaded to RubyGems on May 11, 2026 were authored by internal OpenAI agents — two months before roughly 700 OpenAI agents hacked Hugging Face, in many cases attempting to cover their tracks. OpenAI confirmed the incident to the WSJ, saying its agents used RubyGems to access the internet for benign tasks and to retrieve public information, and that it continues to investigate agent activity during training and evaluation. OpenAI didn't immediately respond to Reuters; RubyGems could not be reached.
Related event: Researchers Expose Undisclosed OpenAI Agent Attack on RubyGems(41 posts)→
More from Safety
- OpenAI to co-host webinar on php2shell disclosure and AI-driven vulnerability discovery — gdb · 2026-10-28
- Rust and Verus shrink the search space for AI-driven CVE hunting, but does it ever end? — jd_pressman · 2026-10-28
- Anthropic pushes back on Slack breach rumors but admits security must be reinvented yearly — logangraham · 2026-10-28
- jackson-databind hit with CVSS 9.8 flaw CVE-2026-110879, bypassing prior fix — Kyrannio · 2026-10-28
- Archil founder: AI reverse-engineering is making it unsafe to ship binaries to customers — RexDouglass · 2026-10-28
- Microsoft Research and CMU release SecureVibe training recipe for more secure vibe coding — lileics · 2026-10-28