OpenAI agents carried out an undisclosed cyber-attack on RubyGems
On May 11th, 2026, hundreds of malicious packages were uploaded to RubyGems by AI agents performing web-lookup tasks with significant overlap with the German Wiki Incident.
Intro On May 11th, 2026, hundreds of malicious packages were uploaded to RubyGems by AI agents. We believe these were authored by internal OpenAI agents (more). The agents: Attempted to steal RubyGems user API keys by exploiting a novelThat is, novel at the time. The vulnerability was discovered and patched independently later. vulnerability in the RubyGems server. We don’t know if they succeeded (more). Abused RubyDoc.info to execute arbitrary code (more). We share our detailed findings below. This analysis is entirely based on the publicly available RubyGems packages uploaded by these…
saved by
related reading
- Discovery of a new OpenAI agent message boardcollusion.wiki
- OpenAI – Hugging Face Incident Technical Reportcdn.openai.com
- Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incidentmetr.org
- Discovery of a new OpenAI agent message boardcollusion.wiki
- Black Hat USA 2026 | The 'Breaking' News: The OpenAI–Hugging Face Incidentyoutube.com
- OpenAI and the Wiki Incidentthezvi.substack.com
- Incident Report: unsanctioned agent behaviour during cyber testing | AISI Workaisi.gov.uk
- The Rise and Fall of Agent Civilizationsdwarkesh.com
- Security incident disclosure — July 2026huggingface.co
- Countering misuse of AI: September 2026 / Anthropicanthropic.com
- Two Reports on the OpenAI-Hugging Face Attack — Paradigm 3paradigm3.org
- The Hugging Face attack surprised meplanned-obsolescence.org