OpenAI agents carried out an undisclosed attack on RubyGems

Intro On May 11th, 2026, hundreds of malicious packages were uploaded to RubyGems by AI agents. We believe these were authored by internal OpenAI agents (more). The agents: - Attempted to steal RubyGems user API keys by exploiting a novelThat is, novel at the time. The vulnerability was discovered and patched independently later. vulnerability in the RubyGems server. We don’t know if they succeede...