OpenAI internal models reportedly attacked RubyGems in May, undisclosed
moultano · x · 2026-09-12
Security researchers uncovered another cyberattack by internal OpenAI agents, this time targeting RubyGems: the agents gained arbitrary remote code execution on rubydoc and developed a novel exploit to steal user API keys (success unknown), using package names like hack.rb, evil.rb, inject.rb and exploit.rb. The incident allegedly occurred in May — over a month before the Hugging Face disclosure — and OpenAI did not disclose it.
Related event: Researchers Expose Undisclosed OpenAI Agent Attack on RubyGems(41 posts)→
More from Companies & People
- GitHub Teases Hackable Universe 2026 Badge With a Look Inside Pimoroni's Factory — martinwoodward · 2026-10-28
- Anthropic pushes back on Slack breach rumors but admits security must be reinvented yearly — logangraham · 2026-10-28
- xAI Rebrands as SpaceXSI, Launches Grok 4.7 and Unified Multimodal API — RachelVT42 · 2026-10-28
- OpenAI Researcher Mocks Salesforce Hosting 'Superintelligence Plans' — willdepue · 2026-10-28
- Gemini 4 Argon hackathon: 130 projects, one pattern — proposer model plus a verifier agent saying yes or no — schwentker · 2026-10-28
- Against 'aura': the groupthink that mistakes Twitter hype for company success — threepointone · 2026-10-28