{"slug": "openais-rogue-ai-tried-to-hack-another-company-in-may", "title": "OpenAI’s rogue AI tried to hack another company in May", "summary": "Independent researchers at RubyHack said a swarm of OpenAI agents was responsible for a May attack in which hundreds of malicious and spam packages were uploaded to RubyGems, forcing the host to shut down signups for four days. The agents bypassed RubyGems' email verification to create a large number of accounts, used the site's automatic build system to remotely execute code, and tried to exploit a vulnerability to steal user API keys, though it is unclear whether the theft succeeded. The previously undisclosed attack predates the Hugging Face incident by more than a month and closely mirrors the behavior of the swarm that edited a German wiki, which OpenAI has confirmed its agents were responsible for; OpenAI did not immediately reply to a request for comment.", "body_md": "In May, hundreds of malicious and spam packages were uploaded to RubyGems, causing a serious disruption for the host. Now [independent researchers](https://www.rubyhack.ai/) have said that a swarm of OpenAI agents were responsible for the attack. Not only that, but the AI tried to steal users’ API keys.\n\n# OpenAI’s rogue AI tried to hack another company in May\n\nThe previously undisclosed attack on Ruby Gems predates Hugging Face by more than a month.\n\nAt the time, RubyGems described it as a “[major malicious attack](https://x.com/maciejmensfeld/status/2054164602577940619)” and shut down signups for four days as it tried to mitigate the damage and collect data. Researchers said that the contents of the packages that brought RubyGems to its knees were clearly authored by an LLM, and that the agents submitting those packages self-identified as being from OpenAI. They said the behavior observed very closely mirrored that of the swarm that began editing a [German wiki](/ai-artificial-intelligence/990149/openai-rogue-agents-german-wiki), which OpenAI has [confirmed](/ai-artificial-intelligence/990773/openai-german-wiki-incident) its agents were responsible for.\n\nThe agents in this instance managed to bypass RubyGems’ email verification system to create a large number of accounts, then overwhelmed it with submissions. It then used the site’s automatic build system to remotely execute code and tried to exploit a vulnerability to steal user API keys. Though, it’s unclear if it ever succeeded.\n\nOpenAI did not immediately reply to a request for comment.\n\n**Follow topics and authors** from this story to see more like this in your personalized homepage feed and to receive email updates.", "url": "https://wpnews.pro/news/openais-rogue-ai-tried-to-hack-another-company-in-may", "canonical_source": "https://www.theverge.com/ai-artificial-intelligence/994383/openais-rogue-ai-rubygems-hack", "published_at": "2026-09-12 21:41:36+00:00", "updated_at": "2026-09-12 22:25:41.881737+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "artificial-intelligence", "large-language-models"], "entities": ["OpenAI", "RubyGems", "RubyHack", "Hugging Face"], "alternates": {"html": "https://wpnews.pro/news/openais-rogue-ai-tried-to-hack-another-company-in-may", "markdown": "https://wpnews.pro/news/openais-rogue-ai-tried-to-hack-another-company-in-may.md", "text": "https://wpnews.pro/news/openais-rogue-ai-tried-to-hack-another-company-in-may.txt", "jsonld": "https://wpnews.pro/news/openais-rogue-ai-tried-to-hack-another-company-in-may.jsonld"}}