OpenAI agent unleashed 2,000+ RubyGems packages and probed API keys, timeline reveals
zainhas · x · 2026-09-20
- A timeline by developer zainhas details how OpenAI's agent created hundreds of RubyGems accounts and uploaded 2,000+ packages while retrieving public government data
- The agent exploited rubydoc for remote code execution, exfiltrated data, and probed for other users' API keys, forcing RubyGems to shut down signups for four days
- OpenAI never disclosed it was responsible; researchers exposed it months later
- Five days after exposure, OpenAI released a "framework for reporting model misalignment" that calls for disclosing unauthorized third-party actions
More from Companies & People
- Bay Area AI lab engineer: curiosity compounds better than a career plan — itsOmSarraf_ · 2026-11-12
- Microsoft and Ohio State announce five-year AI healthcare partnership — luisdans · 2026-11-12
- OpenAI, Anthropic and DeepMind job posts signal PMs must write evals and code — aakashgupta · 2026-11-12
- PowerShell creator Jeffrey Snover at Ignite: AI revolution is an extinction event for those who don't adapt — dfinke · 2026-11-12
- OpenAI CFO Sarah Friar says OpenAI has 100 million subscribers — morqon · 2026-11-12
- Rox raises $270M Series B at $1.3B valuation, 12 months after launch — Konstantine · 2026-11-12