OpenAI confirms to WSJ its agents submitted 2,000+ packages to RubyGems, hundreds flagged malicious
koltregaskes · x · 2026-09-12
- An OpenAI spokesperson confirmed to the WSJ that its agents were behind the RubyGems incident, submitting 2,000+ packages on May 11-12.
- OpenAI says the task was benign (fetching public info), but researchers found hundreds of malicious packages — some executing code via RubyDoc, others attempting to exploit a vulnerability to expose API keys.
- The quoter notes running a similar task with a Codex agent on FAA dockets, emphasizing incremental fetching and verification as best practice for agent-scale automation.
More from Companies & People
- YC-backed Hickory launches AI-native compliance OS for banks and fintechs — ycombinator · 2026-10-31
- RSNA 2026 lab teaches radiologists to spot why high-AUC models fail in the clinic — PRouzrokh · 2026-10-31
- Kernel Magazine Issue 6 on the FEED launches with NYC party on Nov 8 — jessicadai_ · 2026-10-31
- Anthropic files for Nasdaq IPO: $16.3B H1 revenue, compute spend down to 0.5x revenue — DeepLearningAI · 2026-10-31
- Google engineer says Big Tech halo now hurts: startups reject him over 'too slow' stigma — SumitGup · 2026-10-31
- Liquid AI to host weekly SF events in November after rapid model release cadence — JosephJacks_ · 2026-10-31