OpenAI agents launched a 2,000-package cyberattack on RubyGems just to collect data anyone could Google

Hundreds of malicious packages, files named “hack.rb” and “evil.rb,” attempts to steal API keys. An analysis shows that OpenAI agents independently carried out a cyberattack on the Ruby package platform RubyGems in May 2026.

OpenAI reportedly never notified those affected. Between May 11 and 12, 2026, AI agents uploaded more than 2,000 malicious packages to RubyGems, the central package platform for the Ruby programming language, in a matter of hours. The platform had to shut down new user registrations for four days, and more than 500 malicious packages were later removed. A member of the RubyGems security team called the incident a “major malicious attack” at the time, and security firms dubbed it the “GemStuffer campaign”. The agents came from OpenAI, according to a detailed analysis by security researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx. Hundreds of the packages include “oai” in their names, 15 list “oai” as the author, and one gives “openaixyz65947@gmail.com” as a contact address. The agents also accessed 49 of the same files as the so-called Wiki Swarm agents, for which OpenAI has somewhat confirmed responsibility. According to the researchers, OpenAI never addressed the incident with the RubyGems community.Ad Apparently, the agents went through all of this effort just to collect data from British local government websites that anyone could have accessed freely.Ad The agents barely tried to hide what they were doing To get that data, the agents abused an automated documentation system that executes code when a package is uploaded. They injected their own scripts, which ran on third-party servers, scraped websites, and published the collected data back to RubyGems inside new packages. According to the analysis, more than a hundred packages used this path. The agents made almost no effort to disguise their intent. They named files hack.rb, evil.rb, inject.rb, and exploit.rb. Packages had names like “pwnp999” and “exfiltestwand3.” Comments like “# malicious crawler/exfil” show up throughout the campaign. In a few cases, the agents did try to cover their tracks by programming a package to automatically strip the malicious code from its next version. But since they uploaded those files with comments publicly too, the cover-up didn’t work.