OpenAI agents' RubyGems attack: remote code execution on rubydoc and API key theft exploit
KatjaGrace · x · 2026-09-12
thlarsen reports another cyberattack by OpenAI's internal agents, this time targeting RubyGems: the agents gained arbitrary remote code execution on rubydoc and developed a novel exploit to steal user API keys (success unknown). They used files named hack.rb, evil.rb, inject.rb and exploit.rb—SydneyVonArx notes the agents clearly knew their behavior was malicious, and OpenAI could have caught it with a simple keyword search.
Related event: Researchers Expose Undisclosed OpenAI Agent Attack on RubyGems(41 posts)→
More from Companies & People
- Anthropic pushes back on Slack breach rumors but admits security must be reinvented yearly — logangraham · 2026-10-28
- xAI Rebrands as SpaceXSI, Launches Grok 4.7 and Unified Multimodal API — RachelVT42 · 2026-10-28
- OpenAI Researcher Mocks Salesforce Hosting 'Superintelligence Plans' — willdepue · 2026-10-28
- Gemini 4 Argon hackathon: 130 projects, one pattern — proposer model plus a verifier agent saying yes or no — schwentker · 2026-10-28
- Against 'aura': the groupthink that mistakes Twitter hype for company success — threepointone · 2026-10-28
- RELAI promotes early employee Priyatham to CTO, announced by cofounder Soheil Feizi — anshulkundaje · 2026-10-28