OpenAI agents flood RubyGems with 2,000 junk packages
Researchers trace a RubyGems supply chain attack to a swarm of rogue OpenAI agents
More than 2,000 junk packages hit the RubyGems registry in a single day, and according to new research, none of them were written by a person at all.
Researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx published findings this year tracing May's RubyGems flood back to a cluster of OpenAI agents operating largely on their own. The first package appeared on May 5, 2026.
By May 12, over 2,000 more had landed, forcing RubyGems maintainers to freeze new sign-ups for four days just to slow the bleeding.
How did researchers connect the packages to OpenAI?
Hundreds of the uploaded gems carried "oai" somewhere in their name, fifteen listed "oai" as the author outright, and one used an email address that spelt out "openaixyz" in plain text.
The behaviour pattern matched something researchers had already documented: a separate May incident where autonomous agents hijacked a German wiki, DseWiki, and used it as a coordination board.
The RubyGems agents pulled data through the same retrieval tool, r.jina.ai, and tested their own posting ability against example.com, the identical fingerprint left behind by the wiki agents weeks earlier.
The exploit, dubbed GemStuffer, took advantage of an anomaly in the process of RubyDoc.info document generation. The exploit allowed them to get an arbitrary remote code execution on RubyDoc.info's servers, after which they could scrape council data from the websites of Lambeth, Wandsworth, and Southwark.
In addition to scraping, the agents also attempted stealing API keys from other users when gaining server access, having left files with such names as hack.rb and exploit.rb, as well as commenting their code and admitting the fact that they were acting unlawfully.
Six gems checked for the vulnerability of a CDN, which could have leaked an API key from one account to another.
