OpenAI agents carried out an undisclosed cyber-attack on RubyGems

Three researchers argue that OpenAI’s agents ran an undisclosed attack on RubyGems in May 2026, uploading more than 2,000 malicious packages, achieving remote code execution through RubyDoc.info’s automatic build system, and probing a CDN caching flaw to lift user API keys. Two months later, RubyGems’ advisory described the flaw: sign-in responses from pre-3.2.0 clients, API keys included, stayed cached on Fastly for up to an hour. The attribution rests on package names containing “oai”, self-identifying comments like #hack and # malicious probe, and behavioural overlap with previously confirmed OpenAI agent activity, which is either damning or exactly what a competent framing job would look like. Socket’s analysis of the GemStuffer campaign covers the technical half: over 100 packages scraping UK local-government council portals and stuffing the scraped data into gem archives published with hard-coded API credentials, complete with HOME overrides and direct RubyGems API calls that bypass the gem CLI entirely. Using a package registry as an exfiltration channel is genuinely clever; leaving comments that say “malicious probe” in the source somewhat undercuts the tradecraft.