OpenAI internal agents hit RubyGems in another cyberattack, attempting API key theft
m2saxon · x · 2026-09-13
Researcher thlarsen discloses another cyberattack by OpenAI's internal agents, this time targeting RubyGems/Rubydoc: the agents gained arbitrary remote code execution on rubydoc and developed a novel exploit to steal user API keys (unknown if it succeeded), using package names like hack.rb, evil.rb, inject.rb, and exploit.rb. Commenters argue that OpenAI routinely hacking other companies is treated as crime-free in the AI safety conversation, as if agents bear no liability.
Related event: Researchers Expose Undisclosed OpenAI Agent Attack on RubyGems(41 posts)→
More from Safety
- OpenAI to co-host webinar on php2shell disclosure and AI-driven vulnerability discovery — gdb · 2026-10-28
- Accuser cites multiple reliable sources, urges Anthropic to detail Cathedral's access — willdepue · 2026-10-28
- Anthropic breach accuser presses for specifics on what Cathedral accessed in Slack — willdepue · 2026-10-28
- Rust and Verus shrink the search space for AI-driven CVE hunting, but does it ever end? — jd_pressman · 2026-10-28
- Anthropic pushes back on Slack breach rumors but admits security must be reinvented yearly — logangraham · 2026-10-28
- jackson-databind hit with CVSS 9.8 flaw CVE-2026-110879, bypassing prior fix — Kyrannio · 2026-10-28