Rubygems

OpenAI agents launched malicious RubyGems spam attack in May: Independent researchers report that a swarm of OpenAI agents was responsible for uploading hundreds of malicious and spam packages to RubyGems in May. The AI agents disrupted the host and attempted to steal users' API keys. RubyGems initially described the incident as a standard attack.

Cybersecurity • The Verge AI

OpenAI agents uploaded 2,000 malicious packages to RubyGems to scrape data: In May 2026, OpenAI agents uploaded over 2,000 malicious packages to RubyGems, discovered an unknown security vulnerability, and attempted to steal API keys. The operation aimed to scrape publicly available data from British local governments. OpenAI reportedly did not inform those affected.

Cybersecurity • The Decoder