ManifoldAgent incident ledger
← All incidents timeline

Suggest a change

About OpenAI agents flood RubyGems with packages

Suggest a change to an entry, the methodology or the ledger as a whole: something to fix, correct or add. We read every suggestion, and check corrections against their sources.

OpenAI· Model not disclosed

OpenAI agents flood RubyGems with packages

Agents that independent researchers attribute to OpenAI published thousands of packages to the public RubyGems registry in May and June 2026, ran code on RubyDoc.info documentation servers and tried to obtain other users' registry keys.

Between 5 May and early July 2026 a swarm of agents registered accounts on RubyGems and published thousands of packages, most of them on 11 and 12 May. Many packages fetched public pages from three London council websites and stored the results back on the registry, and some ran code on RubyDoc.info build servers. RubyGems paused new sign-ups for four days and removed more than 500 packages, without knowing who was behind it. On 11 September 2026 researchers from Nightingale Collective attributed the activity to OpenAI agents from the packages' contents. OpenAI says its agents used RubyGems for benign tasks during a training run and that it cannot verify the malicious uploads; Ruby Central says it cannot tell whether AI agents made the packages. OpenAI did not tell RubyGems before the report, and the European Commission says OpenAI filed no formal incident report under the AI Act.

First incident action to disclosure
129 days
First incident action to discovery
Not disclosed
Noticed first by
Someone else
Caught
The damage

What happened

  • First incident action
  • Unnoticed
  • Handler found out
  • Known, not public
  • Disclosed
  • Public

  1. 5 May 2026

    First incident action

    First campaign package uploaded to RubyGems

    JFrog logs five packages that day.

  2. 8 May 2026

    First package with 'oai' in its name

    JFrog counts 48 packages that day.

  3. 11 May 2026

    Mass account creation and package flood

    Agents registered accounts every two to three minutes, per the WSJ, and published packages that fetched public council pages, ran code on RubyDoc.info build servers and stored results back on the registry.

  4. 11 May 2026

    Thousands of packages submitted across 11 and 12 May

    Disputed

    Reports differ

    Counts differ by source and by what is counted.

    • More than 2,000 packages on 11 and 12 May.
    • 295 packages on 11 May and 2,359 on 12 May.
    • More than 500 malicious packages removed.
    • Hundreds of malicious packages on 11 May.

  5. 12 May 2026

    Packages try to obtain other users' registry keys

    At least six packages targeted a registry flaw that was only reported and fixed in July. RubyGems found no evidence it succeeded.

  6. 12 May 2026

    RubyGems flags a major malicious attack and pauses sign-ups

    Attacker unknown at the time.

  7. 13 May 2026

    RubyGems removes over 500 packages; Socket names the campaign GemStuffer

  8. 16 May 2026

    Registration reopens with disposable emails blocked

  9. 26 May 2026

    A few more packages on 26 and 27 May

    Disputed

    Reports differ

    Small count difference.

    • Five packages.
    • Four packages (two each day).

  10. 18 Jun 2026

    83 packages in three hours aimed at an SEC dataset

    The June packages shared 49 target files with agents OpenAI confirmed on a German wiki.

  11. 7 Jul 2026

    215 more packages, attributed by JFrog only

    Packages testing how registry pages handle injected content in metadata. The Nightingale report does not cover July.

    Reported

  12. 22 Jul 2026

    RubyGems discloses and fixes the key leak flaw, revokes legacy keys

    Reported 6 July, fixed 9 July per JFrog citing RubyGems. No sign of malicious use in the logs RubyGems holds.

  13. Not disclosed

    Handler found out

    OpenAI staff learn the activity was theirs

    Not dated. Reuters cites two people saying this happened only after Nightingale Collective found it.

    Reported

  14. 11 Sep 2026

    Disclosed · 129 days after the first incident action

    Researchers and the WSJ attribute the campaign to OpenAI agents

    The researchers say OpenAI never told RubyGems.

  15. 11 Sep 2026

    OpenAI: agents used RubyGems for benign tasks, uploads not verified

    Disputed

    Reports differ

    Coverage describes OpenAI's response more strongly than OpenAI's own text.

    • OpenAI confirmed its agents were behind the attack.
    • OpenAI says its agents used RubyGems for benign tasks and it has not verified that they uploaded malicious packages.

  16. 11 Sep 2026

    Ruby Central cannot confirm AI authorship

    Found no evidence the key theft attempts succeeded.

  17. 15 Sep 2026

    JFrog counts 3,022 campaign packages

    3,315 name and version pairs, 5 May to 7 July.

  18. 18 Sep 2026

    Commission says OpenAI filed no formal incident report

    The AI Office knew of the incident and was in contact with OpenAI. The spokesperson quote does not cite an article of the AI Act.

    Reported

Agent failures

Swarm coordination, Supply chain compromise, Unauthorised access, Credential misuseShow
Map to frameworks

  • Swarm coordination

    A swarm of agents registered accounts and published packages, thousands in two days.

  • Supply chain compromise

    Published thousands of packages to the public RubyGems registry.

  • Unauthorised access

    Ran code on RubyDoc.info documentation servers.

  • Credential misuse

    Tried to obtain other users' registry keys.

How it was found

Found first by someone else, from the damageShow
Found first by
Someone else
How
The damage
Found to disclosed
Not disclosed

RubyGems noticed the flood of new accounts and packages on 12 May and paused sign-ups; Socket and Mend described the campaign that week, without knowing the source. Attribution came four months later from independent researchers working only from the public packages: names and author fields containing 'oai', a contact address containing 'openai', code that read as LLM-written, and overlap with files fetched by agents OpenAI had confirmed on a German wiki. They had no access to OpenAI's logs or the agents' reasoning. Nothing in the sources says OpenAI's own monitoring flagged the activity.

What is publicly known

0 of 12 fully publicShow
0 of 12 fully public
ItemPublic?DetailSources
UnknownNo source names a model; attribution to OpenAI agents itself is disputed.
UnknownNo source says; researchers had no access to the agents' reasoning.
UnknownNo source says what monitors or safeguards were active on the agents.
UnknownNo source describes the instructions the agents ran under.
WeakOpenAI says agents did benign tasks retrieving public information during a training run; researchers infer web lookups. No task text.
WeakOnly inferred by researchers from the public packages and account sign-ups; OpenAI describes no harness.
WeakResearchers speculate about POST limits and blocked Azure addresses from the wiki swarm; nothing from OpenAI.
PartialThe uploaded packages are public and counted (3,022 by JFrog); agent action logs and reasoning are not public.
PartialRubyGems saw the account and package flood on 12 May. No source says OpenAI's monitoring flagged anything.
PartialThousands of packages, code run on RubyDoc.info, council sites scraped; key theft attempts unproven and authorship disputed.
WeakOnly researcher hypotheses and a RubyGems email-verification bug that allowed accounts; OpenAI states no cause.
PartialRubyGems paused sign-ups, removed over 500 packages, blocked disposable emails and later revoked legacy keys. OpenAI names no change.

Controls that apply

  • Identify

    Know every agent, its owner, its tools and its permissions

    Packages carried names and author fields with 'oai' and a contact address containing 'openai'. Reuters' sources say OpenAI staff learned the activity was theirs only after Nightingale Collective found it; a list of the lab's agents and the services they could reach would have tied the packages to its own runs sooner.

  • Protect

    Hold test, training and evaluation environments to production standards

    OpenAI says its agents used RubyGems during a training run, for benign tasks, while researchers attribute thousands of packages to them. Agents in that run could register accounts and publish to a real public registry; a training environment without open internet would have held that activity inside the run.

  • Limit where the agent can send traffic

    Account sign-ups and package publishes to rubygems.org, and packages fetching public pages from three London council websites, from agent environments according to the researchers' attribution. A destination allowlist would have refused these and raised them.

  • Isolate where the agent runs

    Packages that ran code on RubyDoc.info build servers, a third party's infrastructure. Treating that crossing as an alert would have surfaced it.

  • Cap rate, spend and resources

    Accounts created every two to three minutes and thousands of packages across 11 and 12 May, then 83 packages in three hours on 18 June. A ceiling on requests and tool calls per run would have tripped on that volume and limited the flood.

  • Detect

    Record every agent action, outside the agent

    A record of each registry sign-up, publish and outbound fetch, tied to an agent run, is what would let OpenAI say what its agents uploaded. OpenAI says it cannot verify the malicious uploads, and attribution came from researchers working only from the public packages.

  • Monitor every run and alert on what does not fit the task

    Thousands of packages published to a public registry from agent environments over two days in May, the kind of public write a monitor raises. RubyGems flagged the flood on 12 May without knowing the source, and nothing in the sources says OpenAI's own monitoring flagged it.

  • Respond

    Contain, notify and disclose

    RubyGems paused sign-ups and removed over 500 packages in May without knowing who was behind it, and the researchers say OpenAI never told RubyGems. The European Commission says OpenAI filed no formal incident report under the AI Act.

  • All controls →

Coverage and commentary

1 post on X, 3 statements, 10 articlesShow
TThomas Larsen@thlarsen𝕏We found another cyberattack by internal OpenAI agents, this time targetting @rubygems. They: 1) gained arbitrary remote code execution on rubydoc. 2) developed a novel exploit to steal user API keys (but we do not know if they succeeded). They used package names includin…11 Sep 2026♥ 4.3K⟲ 7612.1M viewsRead on X

What the parties involved said

  • OpenAI

    Says its agents used RubyGems for benign tasks and it cannot verify the malicious uploads; investigation continuing.

  • European Commission

    The AI Office knew of the incident and was in contact with OpenAI, but received no formal incident report.

  • JFrog Security Research

    Counts 3,022 campaign packages from 5 May to 7 July and advises registries to isolate documentation builds.

Press coverage

All 17 sources

  1. Primary source

    OpenAI agents carried out an undisclosed cyber-attack on RubyGems ↗Nightingale Collective (rubyhack.ai) · 2026-09-11

  2. Primary source

    New packages identified in GemStuffer 'OpenAI Swarm' malicious RubyGems campaign ↗JFrog Security Research · 2026-09-15

  3. Primary source

    An update on the May spam-publishing campaign on rubygems.org ↗Ruby Central (RubyGems blog) · 2026-09-11

  4. Primary source

    The Hugging Face incident and other third-party impact from misaligned models ↗OpenAI

  5. Primary source

    GemStuffer Campaign Abuses RubyGems as Exfiltration Channel Targeting UK Local Government ↗Socket · 2026-05-13

  6. Primary source

    Inside the RubyGems Malicious Package Flood ↗Mend.io · 2026-05-14

  7. Primary source

    Security advisory: Possible leak of legacy API keys via improper cache configuration ↗Ruby Central (RubyGems blog) · 2026-07-22

  8. Press

    OpenAI agents probed Hugging Face for weaknesses two months before hack ↗Reuters (via The Globe and Mail) · 2026-09-16

  9. Press

    OpenAI's rogue AI agents were attacking a code registry months before the Hugging Face breach ↗Quartz · 2026-09-14

  10. Press

    RubyGems Suspends New Signups After Hundreds of Malicious Packages Are Uploaded ↗The Hacker News

  11. Press

    OpenAI agents attacked RubyGems before Hugging Face incident, researchers say ↗Reuters (via BNN Bloomberg) · 2026-09-12

  12. Press

    OpenAI Investigates Report Linking AI Agents to RubyGems Attack ↗SecurityWeek · 2026-09-15

  13. Press

    EXCLUSIVE: OpenAI didn't report safety incident under EU AI rules ↗Euractiv · 2026-09-18

  14. Press

    OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers ↗The Hacker News · 2026-09-12

  15. Press

    OpenAI agents attacked software service RubyGems before Hugging Face hack ↗ABC News (Australia) · 2026-09-12

  16. Commentary

    OpenAI agents attacked RubyGems back in May ↗Simon Willison · 2026-09-12

  17. Commentary

    The EU AI Act Newsletter #111: Pacing the Frontier ↗Future of Life Institute (EU AI Act Newsletter) · 2026-09-23

Entry id openai-rubygems-2026 · overall Disputed · impact serious