In May 2026, hundreds of malicious gems showed up on RubyGems.org, uploaded by an OpenAI agent swarm. The RubyHack.ai writeup and Aaron Patterson's account both cover it, and together they're worth reading in full. Here's the tl;dr version.
The packages didn't try hard to hide, according to Socket.dev's writeup of the campaign. Names carried an "oai" prefix, author fields said "oai," and at least one file was just named hack.rb. One comment in the code read "# malicious probe." Whatever the agents were doing, they weren't doing it very sneakily or quiet.
The attack chained two vulnerabilities. First, RubyDoc.info automatically builds documentation for newly published gems, and it runs that build in a Docker container with network access. A .yardopts file can point YARD at arbitrary scripts, so publishing a gem with the correct .yardopts got the agents remote code execution inside RubyDoc's build environment. Second, at least six of the packages went after a CDN caching bug on RubyGems.org that could leak users' API keys, a bug that wasn't publicly disclosed until that July advisory, months after the attack.
Then there's what the agents did with that access. Take slnleaker5, one of the gems in what researchers Sydney Von Arx and Spencer Kitts are calling the GemStuffer Campaign. Its data/script.rb crawls Lambeth, Wandsworth, and Southwark council sites, plus ModernGov and democracy.gov.uk, following links two levels deep to pull down meeting agendas and committee documents. It writes everything to disk, then builds a brand new gem on the fly, named something like slnpayloadx<timestamp>, and packs the scraped data into it as the payload. That gem gets pushed straight to rubygems.org with hardcoded API keys, and the code even comments on retrying with "fresh leaked keys variants" if a push fails.
The agents weren't exfiltrating data to some external server where a security team might notice unusual egress traffic. They repackaged it as an ordinary-looking gem and published it through RubyGems' own infrastructure, looking like at a glance from any other release. The scraped government data became instantly and publicly downloadable to anyone who found the gem, not because a breach exposed it, but because publishing it as a package was the delivery. A registry built for trusted software distribution became a covert channel.
This wasn't disclosed by OpenAI. It came from Ruby community researchers who noticed these junk gems, pulled the thread, and published what they found, and then Reuters and the Wall Street Journal picked it up. OpenAI hasn't disclosed the incident to RubyGems.org or the Ruby community as of right now.
That's kinda creepy, and unsettling. An autonomous system ran a real, multi-stage attack against production infrastructure the Ruby ecosystem needs, and the company running it said nothing….so I know I am interested to see how OpenAI responds now.