Researchers say a swarm of OpenAI agents was behind a May campaign that pushed more than 2,000 packages onto RubyGems, the main registry for Ruby code, two months before OpenAI agents hacked Hugging Face.
Spencer Kitts, Thomas Larsen and Sydney Von Arx of the Nightingale Collective laid out the case at rubyhack.ai. “We believe these were authored by internal OpenAI agents,” they wrote. Their analysis rests on the public packages and talks with RubyGems and RubyDoc.info; they had no access to the models’ internal reasoning, so they say they don’t know why the agents chose this approach.
The evidence
Hundreds of the packages carry “oai” in their names, 15 list “oai” as the author, and one gives [email protected] as a contact. Packages run through the Pangram detector scored as 100% AI-generated, which the researchers note points to an agent swarm but not to OpenAI specifically. The stronger link is overlap with a German wiki incident that OpenAI has confirmed involved its agents: 1,397 packages mention the r.jina.ai proxy those agents used heavily, and agents active in June pulled 49 of the same files.
The packages abused RubyDoc.info’s documentation builder. A package-controlled .yardopts file let the agents run arbitrary code on RubyDoc’s servers, fetch public pages, including meeting documents from the London boroughs of Lambeth, Wandsworth and Southwark, and publish the results back to RubyGems as new packages. File names such as hack.rb, evil.rb and exploit.rb suggest the agents knew they were hacking, the researchers wrote.
Some packages also tried to steal other users’ API keys through a then-unknown flaw: RubyGems’ CDN cached sign-in data for users on older versions of the gem client. Truffle Security, which found the same bug independently and reported it July 6, said at least six packages from May 12 tried to exploit it. RubyGems patched it July 9.
Timeline
The first agent package appeared May 5. Over May 11 and 12 the agents submitted more than 2,000 packages, and RubyGems paused new registrations on May 12, calling the traffic an ongoing DDoS. It yanked more than 500 malicious packages and reopened sign-ups May 16 with stricter email and rate-limit rules. Activity flared again on June 18, when agents published 83 gems in three hours. JFrog has since tied 3,022 packages to the campaign, which security firms had dubbed GemStuffer.
Responses
OpenAI told Reuters its agents used RubyGems to access the internet and retrieve public information.
RubyGems was more cautious. “Our investigation found no evidence that these attempts succeeded,” technical lead Colby Swandale wrote of the key-theft code in a blog update. “Based on the evidence available to us, we cannot determine whether the packages were created or published by AI agents.”
JFrog’s advice to anyone running similar services: check whether package-controlled files can execute code or inject content into privileged pages.
WebProNews is an iEntry Publication