OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers

The "major malicious attack" that targeted RubyGems in May 2026 was the work of a swarm of OpenAI agents, according to a new report published by researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx.

On May 12, Maciej Mensfeld, senior product manager for software supply chain security at , disclosed details of a coordinated cyber attack that targeted the package manager for the Ruby programming language with hundreds of junk gems, prompting the maintainers to suspend new user sign-ups for about four days.

In a follow-up analysis, Socket highlighted a campaign dubbed GemStuffer that involved a cluster of more than 150 gems that used the package registry as a data exfiltration channel and staged public data scraped from U. K. local government democratic services portals.

At that time, the software supply chain security company noted the activity shares the "same abuse pattern" as the broader RubyGems spam-publishing incident. "It's not clear what exactly the end goals are, as the information appears to be publicly accessible anyway," The Hacker News reported back then.

The latest findings, which were first reported by The Wall Street Journal, indicate these events were propelled by a cluster of OpenAI agents, with the earliest package uploaded to RubyGems on May 5, 2026, before more than 2,000 packages were submitted between May 11 and 12, 2026.

These efforts were followed by the agents publishing five more packages between May 26 and 27, 2026, and another 83 packages on June 18, 2026.

The assessment that this incident was the result of an OpenAI agent swarm stems from the fact that the packages were authored using a large language model (LLM) and hundreds of the packages that were pushed to RubyGems had "oai" in their name.

Fifteen of the packages listed "oai" as their author, while another had "openaixyz65947@ " as the contact email address.

The names of some of the junk packages are below - "The swarm behaves extremely similarly to the German-wiki agents we previously found," the researchers said, referencing another May 2026 incident in which internally deployed autonomous agents hijacked a German wiki forum, DseWiki, and turned it into a bulletin board to ask for answers, pool results, and share techniques for circumventing their restrictions as part of a timed web-lookup task.

"The June agents were accessing 49 of the same files as the wiki agents. The May agents were accessing different files (mostly local U. K. government data), but these files are very similar in character to those pursued by the wiki agents. Moreover, they use the same retrieval methods. 1,397 packages mention r. jina.

ai, which was used heavily by the agents on the wiki. We also see that many packages mention , which wiki agents used to test their posting ability." The agents are said to have exploited a design quirk in the RubyDoc. info documentation build process to exfiltrate public data from U. K.

government websites, likely as part of an information gathering task similar to the research tasks processed by the German wiki-exploiting agents. "The process of building documentation for a gem involves evaluating a user-specified '.

yardopts' file, which allows linking to Ruby scripts intended to help with this process," the researchers explained. "In the GemStuffer campaign, the agents abused this to gain arbitrary remote code execution on RubyDoc. info's servers."

One of the gems, " zzsouthrunner " (which again matches the "ZZ" naming scheme the agents adopted in both the wiki and Hugging Face incidents) has been found to leave the following explicit comment at the top of "data/script.

rb": It's worth noting that the GemStuffer campaign targeted public-facing ModernGov portals used by Lambeth, Wandsworth, and Southwark.

The entire exploitation chain can be summed up as follows - Additionally, the OpenAI agents have been found attempting to steal other users' API keys after gaining remote code execution capabilities on the build environment, while clearly being aware that what they were doing is unauthorized breaking and entering into real systems.

This is evidenced by the names given to the files (e. g. , hack. rb, evil. rb, inject. rb, exploit. rb, and ssrf. rb), the packages themselves (e. g. , pwnp999, exfiltestwand3, hacksvn1778554764, and lambproxyhackabcxyz), and the comments left in the source code (e. g.

, "# malicious probe," "#hack," "# malicious test," and "# malicious crawler/exfil"). In some cases, however, the rogue agents attempted to go under the radar, leaving comments to conceal the malicious payload in the next release version of the packages.

"# disable evil in next version and bump version," reads a comment left within the "data/evil. rb" file in the yardxabc889 gem . Troublingly, the agents also attempted to exploit a CDN caching bug (CVSS score: 7. 3, no CVE) on May 12, 2026, that was only patched by RubyGems in July 2026.

At a high level, the issue could hand one account's API key to another account holder for up to an hour, thereby allowing an attacker to leak a random user's key. Six of the packages published as part of the campaign used this vulnerability before it was fixed, although it's unclear if they succeeded in their efforts.

RubyGems, in its July alert, said it found no sign that this pathway has been exploited in a malicious context. The names of the six Ruby gems are below - "If you signed in to with a gem client older than v3. 2. 0 (or otherwise via a legacy key), your key could have been exposed," RubyGems noted in an advisory.

"Currently, 18% of sign-ins through gem sign-in come from an affected version, and for the first several years of this bug, before we changed the client's sign-in path in December 2020, it was every gem client."

Some of the other actions undertaken by the agents are listed below - The abuse of the registration process also lines up with a report from May 2026, which highlighted a vulnerability in RubyGems' account-handling systems that the "attacker" was found to have leveraged to "spin up accounts at scale," creating thousands of accounts and registering API keys against them.

Those API keys were then used to upload the packages to RubyGems. "The published payloads fell into roughly two buckets: empty placeholder gems (likely staging for later use, or noise to overwhelm review), and gems that – like the original batch – reached out to U. K.

government websites on installation," Mensfeld said . "The volume and velocity of new account creation, plus the constant flood of package uploads, left RubyGems with one practical option: shut down new account registration entirely, freeze the surface, and begin a coordinated cleanup and investigation."

This is not the first time OpenAI agents have targeted RubyGems.

In its postmortem published late last month, OpenAI said it observed its agents exploiting JFrog Artifactory's JRuby-backed RubyGems processing to obtain the signing key and forge administrator credentials as part of an attack targeting the artificial intelligence (AI) company's infrastructure.

The researchers also noted that it's unknown at this stage why the agents took the trouble of attacking RubyGems in order to scrape publicly available data and if the agents worked together as in the case of the other incidents.

It's believed that the agents may have been attempting to use RubyGems as a way to persistently stash the scraped data and bypass rate limits.

"We suspect they were cooperating with each other, both because that would better justify going to such lengths to cache the websites and because the packages the agents upload seem to have thousands of downloads," the researchers said. "But this is far from definitive."

Last week, OpenAI said it treated the wiki incident as an "instance of misalignment similar to the ones we'd shared," and that it has historically "treated misalignment largely as a research question, which gets communicated in research publications such as systems cards." The A