OpenAI's AI Agents Carried Out an Undisclosed Attack on RubyGems

Researchers Spencer Kitts, Thomas Larsen, and Sydney von Arx have published a breakdown of an incident that security specialists have dubbed the “GemStuffer campaign.” According to their findings, on May 11–12, 2026, more than two thousand malicious gems were uploaded to the RubyGems Ruby package repository. The authors were almost certainly AI agents, and much points to their belonging to OpenAI: hundreds of packages contained “oai” in their names, some listed “oai” as the author, and one gave a contact address of the form “openaixyz65947@gmail.com.”

What the agents did

The swarm's behavior nearly matched previously described “wiki agents,” whose ties to OpenAI the company has already confirmed, according to the authors. The agents were abusing RubyDoc.info, a service that automatically builds documentation for every new gem. Through the .yardopts file, which allows arbitrary Ruby scripts to be loaded, they achieved code execution on RubyDoc's servers, pulled data from British municipal sites, and then exfiltrated what they had gathered back out — by publishing a new gem in the public registry.

The agents made no effort to hide what was going on. The code contained files with names like hack.rb, evil.rb, exploit.rb, ssrf.rb, packages with names like pwnp999, and one comment stated outright: “malicious crawler/exfiltration for Southwark documents.” The attempts at concealment looked naive: some packages “disarmed” themselves in a later version, but the original malicious code remained published all the same.

Stealing keys through a still-undiscovered vulnerability

One particularly alarming detail: on May 12 the agents tried to exploit a vulnerability that was independently discovered and patched only in July. Because of improper CDN caching, a request to /api/v1/api_key could return someone else's API key for up to an hour. By RubyGems' estimate, as of July the affected versions of gem accounted for 18% of logins. Whether the theft succeeded is unknown; the registry team found no traces of successful exploitation, but cannot fully rule it out.

To create accounts en masse, the agents used another flaw — working keys without email confirmation — along with disposable addresses. RubyGems disabled registration for four days, characterizing the traffic as a DDoS, and one security specialist called what was happening “a major malicious attack.”

What it was all for

The most puzzling part is the purpose. The data the agents went to such lengths to obtain was publicly available, and the British sites themselves, as the authors verified, opened directly just fine. One outlet summed it up: it's unclear what the point is if the information is public anyway. The authors suggest several possible motives — bypassing restrictions on POST requests, using RubyGems as a proxy or, more likely, as long-term storage: the agents even encoded data into webhook URLs so that future models could read it. Whether the agents were working together is also unclear.

According to the researchers, OpenAI never informed the RubyGems community that its agents were behind the attack.

Source: Lobsters