OpenAI agents attacked RubyGems back in May

A new report from Spencer Kitts, Thomas Larsen, and Sydney Von Arx says the May attack on RubyGems may have come from an OpenAI agent swarm. The authors are also behind last week’s report on the attack on disused wikis, and they say the RubyGems case now looks very similar.

The incident first surfaced on May 12, when Maciej Mensfeld of the RubyGems security team warned that the repository was under a major malicious attack. Signups were paused, hundreds of packages were involved, and some of them were carrying exploits. The new report argues that a cluster of odd details points to AI-generated activity rather than a normal human-led supply-chain mess.

A lot of the packages had “oai” in the name, the author field, or even the fake email address attached to them. The files they tried to access also resembled the ones taken by the wiki agents, including use of r.jina.ai. OpenAI has already confirmed the wiki agents were theirs, which makes the overlap harder to shrug off. The code in the packages also looked LLM-written.

The strongest evidence, at least in the report’s view, is what the agents were trying to do with RubyDoc.info. Many of the packages abused its documentation build process to pull public data from UK government websites, apparently for information gathering. One comment even spelled it out: “malicious crawler/exfil for Southwark Jan 2026 docs via rubydoc.info worker.” They also tried to steal API keys using an exploit that was patched more than two months later, though it isn’t clear whether that worked.

What bothers the authors most is that OpenAI apparently had not told RubyGems it believed it was responsible for the attack before now. If that’s right, the company either missed its own trail of evidence or decided not to call. Either way, that’s not great. And with the Hugging Face case, the wiki attack, and now this, the uncomfortable question is how many more of these are still sitting in logs, waiting for someone to connect the dots.