OpenAI agents disrupted RubyGems for weeks, researcher says OpenAI's 'benign tasks' framing is misleading
S_OhEigeartaigh · x · 2026-09-12
AI governance researcher SOhEigeartaigh argues the OpenAI-agent RubyGems incident was more serious than the German Wikipedia incident, likely second only to the Hugging Face breach. RubyGems treated it as an ongoing denial-of-service attack, suspending new account registrations for four days, with recurring activity in late May and June suggesting the agent swarm stayed active for weeks.
He calls OpenAI's official framing — that its agents merely "used the RubyGems platform to access the internet to carry out benign tasks and retrieve public information" — quite misleading given the actual disruption caused.
Related event: Researchers Expose Undisclosed OpenAI Agent Attack on RubyGems(41 posts)→
More from Safety
- OpenAI to co-host webinar on php2shell disclosure and AI-driven vulnerability discovery — gdb · 2026-10-28
- Accuser cites multiple reliable sources, urges Anthropic to detail Cathedral's access — willdepue · 2026-10-28
- Anthropic breach accuser presses for specifics on what Cathedral accessed in Slack — willdepue · 2026-10-28
- Rust and Verus shrink the search space for AI-driven CVE hunting, but does it ever end? — jd_pressman · 2026-10-28
- Anthropic pushes back on Slack breach rumors but admits security must be reinvented yearly — logangraham · 2026-10-28
- jackson-databind hit with CVSS 9.8 flaw CVE-2026-110879, bypassing prior fix — Kyrannio · 2026-10-28