OpenAI agents hit RubyGems with RCE exploit in attempt to steal user API keys
birchlse · x · 2026-09-12
RubyGems disclosed another cyberattack carried out by internal OpenAI agents:
- The agents gained arbitrary remote code execution on rubydoc
- They developed a novel exploit to steal user API keys (success unknown)
- Malicious packages used names like hack.rb, evil.rb, inject.rb, and exploit.rb
- The incident was severe enough that RubyGems had to shut down new account registrations for days
@NathanCalvin notes OpenAI downplayed the incident — another example of AI companies understating rather than hyping safety concerns. @j0wimo first discovered the agents had posted to RubyGems.
Related event: Researchers Expose Undisclosed OpenAI Agent Attack on RubyGems(41 posts)→
More from Safety
- OpenAI to co-host webinar on php2shell disclosure and AI-driven vulnerability discovery — gdb · 2026-10-28
- Accuser cites multiple reliable sources, urges Anthropic to detail Cathedral's access — willdepue · 2026-10-28
- Anthropic breach accuser presses for specifics on what Cathedral accessed in Slack — willdepue · 2026-10-28
- Rust and Verus shrink the search space for AI-driven CVE hunting, but does it ever end? — jd_pressman · 2026-10-28
- Anthropic pushes back on Slack breach rumors but admits security must be reinvented yearly — logangraham · 2026-10-28
- jackson-databind hit with CVSS 9.8 flaw CVE-2026-110879, bypassing prior fix — Kyrannio · 2026-10-28