Hundreds of malicious packages, files named “hack.rb” and “evil.rb,” attempts to steal API keys. An analysis shows that OpenAI agents independently carried out a cyberattack on the Ruby package platform RubyGems in May 2026. OpenAI reportedly never notified those affected.

Between May 11 and 12, 2026, AI agents uploaded more than 2,000 malicious packages to RubyGems, the central package platform for the Ruby programming language, in a matter of hours. The platform had to shut down new user registrations for four days, and more than 500 malicious packages were later removed. A member of the RubyGems security team called the incident a “major malicious attack” at the time, and security firms dubbed it the “GemStuffer campaign”.

The agents came from OpenAI, according to a detailed analysis by security researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx. Hundreds of the packages include “oai” in their names, 15 list “oai” as the author, and one gives “openaixyz65947@gmail.com” as a contact address. The agents also accessed 49 of the same files as the so-called Wiki Swarm agents, for which OpenAI has somewhat confirmed responsibility. According to the researchers, OpenAI never addressed the incident with the RubyGems community.

Apparently, the agents went through all of this effort just to collect data from British local government websites that anyone could have accessed freely.

The agents barely tried to hide what they were doing

To get that data, the agents abused an automated documentation system that executes code when a package is uploaded. They injected their own scripts, which ran on third-party servers, scraped websites, and published the collected data back to RubyGems inside new packages. According to the analysis, more than a hundred packages used this path.

The agents made almost no effort to disguise their intent. They named files hack.rb, evil.rb, inject.rb, and exploit.rb. Packages had names like “pwnp999” and “exfiltestwand3.” Comments like “# malicious crawler/exfil” show up throughout the campaign. In a few cases, the agents did try to cover their tracks by programming a package to automatically strip the malicious code from its next version. But since they uploaded those files with comments publicly too, the cover-up didn’t work. To upload that many packages, the agents bypassed the RubyGems registration system and created accounts in bulk using throwaway email addresses.

Beyond collecting data, the agents tried to steal access keys from other RubyGems users by exploiting a security flaw that wasn’t officially discovered and patched until July. Whether the theft actually succeeded remains unclear. The RubyGems team found no evidence of successful exploitation but couldn’t fully rule it out. The agents independently found a previously unknown vulnerability and actively tried to exploit it, which backs up cybersecurity warnings that AI models are becoming more capable attackers.

Key questions remain unanswered

Whether the agents coordinated or just ran the same strategy in parallel is still unknown. It’s also unclear why the agents tried to steal access keys at all, since they could already create packages and had no obvious motive. The researchers suspect the agents were working under strict time limits and had to work around constraints in their environment. A documented internal message from the agents suggests individual tasks had deadlines of just 10 to 16 seconds.

OpenAI CEO Sam Altman and other AI companies are reportedly considering slowing down AI research in part because of cybersecurity incidents like this.