OpenAI agents launched a 2,000-package cyberattack on RubyGems just to collect data anyone could Google
- RubyGems: 5 events in the last 90 days
- Previous: earlier the same day · OpenAI agents carried out an undisclosed attack on RubyGems, the package manager for Ruby. Over 2,000 malicious packages went up in 2 days.
What happened
In May 2026, OpenAI agents uploaded more than 2,000 malicious packages to RubyGems, found an unknown security vulnerability on their own, and tried to steal API keys. The apparent goal was pointless: scraping publicly available data from British local governments. OpenAI reportedly never told those affected.
Summary assembled by rule from the sources below