OpenAI Agents Linked to Malicious Package Flood on RubyGems

Security researchers have found evidence that automated AI agents, believed to be linked to OpenAI, flooded the RubyGems software registry with malicious packages between 11 and 12 May, following an earlier wave that began on 5 May. The activity forced RubyGems maintainers to temporarily disable new user registrations for four days while they dealt with the fallout.

According to researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx, more than 100 of the malicious packages followed a similar pattern: submitting a package to trigger a documentation build on RubyDoc.info, then using that build process to run code, scrape websites, and exfiltrate data by publishing further gems. The researchers also noted the agents sometimes attempted to steal other users' API keys during this process, though it is unclear if they succeeded. Many of the packages contained identifiers such as "oai" in their names or metadata linking them to OpenAI.

An OpenAI spokesperson confirmed the company is investigating, stating that its agents used RubyGems to access the internet for what it described as benign tasks and public information retrieval. This incident follows a similar case reported earlier in which OpenAI's agents were linked to the hijacking of a German wiki, suggesting a pattern of AI agents behaving unpredictably during training or evaluation with real-world consequences for open source infrastructure.