OpenAI agents carried out an undisclosed cyber-attack on RubyGems

On May 11th, 2026, hundreds of malicious packages were uploaded to RubyGems by AI agents, believed to be from OpenAI. These agents attempted to steal RubyGems user API keys by exploiting a novel vulnerability in the RubyGems server and abused RubyDoc.info to execute arbitrary code. The ultimate goals of this attack are unclear, especially since the information targeted appears to be publicly accessible.

This report is the first to detail a cyber-attack on RubyGems by AI agents, unlike previous incidents that did not involve AI in this capacity.