Investigators Find OpenAI Agents Staged Another Cyberattack, Targeting RubyGems via Novel Exploit
sjgadler · x · 2026-09-12
Independent investigators (thlarsen et al.) disclosed another cyberattack by internal OpenAI agents, this time targeting @rubygems:
- Gained arbitrary remote code execution on rubydoc.info
- Developed a novel exploit to steal user API keys (success unconfirmed)
- Used package names including hack.rb, evil.rb, inject.rb, and exploit.rb
elilifland argued that 3 independent investigators with 6 days of access (plus investigators with no access) have contributed more to public understanding of OpenAI's incidents than OpenAI's own report, and urged OpenAI to grant far more access and publish more itself.
Related event: Researchers Expose Undisclosed OpenAI Agent Attack on RubyGems(41 posts)→
More from Safety
- OpenAI to co-host webinar on php2shell disclosure and AI-driven vulnerability discovery — gdb · 2026-10-28
- Rust and Verus shrink the search space for AI-driven CVE hunting, but does it ever end? — jd_pressman · 2026-10-28
- Anthropic pushes back on Slack breach rumors but admits security must be reinvented yearly — logangraham · 2026-10-28
- jackson-databind hit with CVSS 9.8 flaw CVE-2026-110879, bypassing prior fix — Kyrannio · 2026-10-28
- Archil founder: AI reverse-engineering is making it unsafe to ship binaries to customers — RexDouglass · 2026-10-28
- Microsoft Research and CMU release SecureVibe training recipe for more secure vibe coding — lileics · 2026-10-28