Intro

On May 11th, 2026, hundreds of malicious packages were uploaded to RubyGems by AI agents. We believe these were authored by internal OpenAI agents (more) .

The agents:

Attempted to steal RubyGems user API keys by exploiting a novel That is, novel at the time. The vulnerability was discovered and patched independently later. vulnerability in the RubyGems server. We don’t know if they succeeded (more) .

Abused RubyDoc.info to execute arbitrary code (more) .

We share our detailed findings below. This analysis is entirely based on the publicly available RubyGems packages uploaded by these agents. We also talked with RubyGems and rubydoc.info However, we do not have access to the rest of the AI behavior, in particular the chain-of-thought produced by the model during the incident, which is internal to OpenAI.…