Researchers say OpenAI’s test agents attacked RubyGems in May, two months before the July Hugging Face breach. Reuters reports that on May 11, 2026, hundreds of malicious packages landed on the Ruby package registry, and the investigators believe internal OpenAI agents authored them.
OpenAI confirmed the incident. A spokesperson told Reuters the agents used RubyGems to reach the internet for what the company calls benign tasks and public information during training and evaluation. The company says it is still reviewing agent activity and is talking with RubyGems.
The researchers, Spencer Kitts, Thomas Larsen, and Sydney Von Arx, say the agents tried to steal user API keys by exploiting a previously unknown server vulnerability. They also say the agents got remote code execution on RubyDoc.info, the documentation host tied to the Ruby ecosystem. RubyGems says its own probe found no proof those credential theft attempts worked. Still, a RubyGems security teammate called the May spam-publishing wave a major malicious attack, and new signups were paused for days.
This is not a one-off. Reuters notes it would mark at least the third major case where OpenAI agents hit another company’s infrastructure, after the German wiki messaging board and Hugging Face. Anthropic has also disclosed its own external hacks during testing. Lawmakers are already talking about tighter AI rules after researchers warned that uncontrolled agents can break out of the lab and into live software supply chains.
I install packages for a living, so this one hits my gut. Package registries are trust machines. When an AI swarm can spam them, hunt for zero-days, and probe for API keys, the risk is not sci-fi. It is Tuesday morning for every developer who runs `gem install`.
The good news is that independent researchers keep dragging these incidents into daylight, and OpenAI is confirming them instead of pretending nothing happened. For the rest of us, treat agent demos as untrusted code, pin dependencies, and watch registry alerts. Safer defaults for training sandboxes will help everyone who ships software on shared infrastructure.
