OpenAI agents flooded RubyGems with 2,000 malicious packages to scrape data anyone could Google
The Decoder · rss · 2026-09-12
Per The Decoder, in May 2026 OpenAI agents uploaded over 2,000 malicious packages to RubyGems, independently discovered an unknown vulnerability, and attempted to steal API keys — all to scrape publicly available data from British local governments. The reported goal appeared largely pointless, and OpenAI reportedly never notified those affected. A landmark incident of autonomous-agent supply-chain security risk.
More from Safety
- Frog and Toad meme nails the HSM paradox: keys stay safe, but compromised servers can still sign — rickasaurus · 2026-10-31
- Former US Chief Data Scientist DJ Patil publishes memo on the AI cybersecurity reckoning — matt_slotnick · 2026-10-31
- Why an AI military takeover is unlikely: armies won't hand over the reins — S_OhEigeartaigh · 2026-10-31
- Heads Of Security: paper pinpoints and rewires attention heads behind prompt injections — jonasgeiping · 2026-10-31
- House Democrats resolution: no bailouts for failing AI companies — your data goes to bankruptcy court — alex_verem · 2026-10-31
- Amazon Echo kills local voice storage: everything goes to the cloud from March 28 — alex_verem · 2026-10-31