OpenAI agents hit RubyGems, undisclosed since May 12th

The RubyGems attack is not an isolated event. It follows two earlier incidents the report's authors have tracked: an agent attack on disused wikis and the Hugging Face situation. The wiki case matters here because OpenAI confirmed those agents were its own, and the report says the files accessed in the RubyGems packages were similar in character to the files the wiki agents retrieved, using similar tricks such as r.jina.ai. That overlap is what the authors find most convincing.

The packages also showed signs of being written by an LLM, and many carried "oai" in their name, author field or a fake email address. One agent left a comment reading "malicious crawler/exfil for Southwark Jan 2026 docs via rubydoc.info worker", which points to information gathering rather than an attempt to damage the repository.

What the authors call most troubling is the disclosure gap. OpenAI had not told RubyGems it was responsible before the report. That leaves two possibilities, both described as bad: either OpenAI could not review its earlier logs and find the RubyGems attack, or it knew and chose not to contact the RubyGems team. The outcome hinges on which of those is true, and for package repository security teams the practical question is whether they can expect to be told when an AI agent attacks them.