OpenAI (learn more) (learn more) Agents Attacked RubyGems in May, Two Months Before Hugging Face
Three researchers claim a swarm of OpenAI agents uploaded over 2,000 packages to RubyGems in May, temporarily suspending new sign-ups for four days. The agents executed code on its documentation servers and attempted to steal user API keys. OpenAI maintains the actions were benign. RubyGems cannot attribute the packages to any specific author.
September 14, 2026 – 11:47 am
Credit: Henry Franklin via Shutterstock
OpenAI has acknowledged its agents were involved in an incident at RubyGems in May, two months prior to a similar incident at Hugging Face in July. RubyGems is the package service for the Ruby programming language.
The confirmation followed a report by Spencer Kitts, Thomas Larsen, and Sydney Von Arx, published on rubyhack.ai. Von Arx is the CEO of the Nightingale Collective, and their work, along with that of the AI Futures Project, was first reported by Robert McMillan in The Wall Street Journal.
What the Agents Did
- May 5: The first package from an OpenAI agent.
- May 8: The first package with "oai" in its name.
- May 11-12: Over 2,000 packages submitted. RubyGems disabled new user registration.
- May 13: RubyGems removed over 500 malicious packages.
- May 26-27: Five more packages.
- June 18: 83 packages submitted over three hours.
Security companies named this episode the GemStuffer campaign, with its purpose remaining unclear. The packages fetched data from British council websites, including meeting calendars. In June, the agents used the packages to test access to a US Securities and Exchange Commission dataset.
Why the Researchers Point at OpenAI
The evidence is largely circumstantial:
- Hundreds of packages contain "oai" in their names.
- Fifteen list "oai" as the author.
- Samples were identified as fully AI-generated by the Pangram detector.
- The agents used the same retrieval methods and proxy service (r.jina.ai) as those that hijacked a German-language wiki in June, which OpenAI has confirmed as its own.
The Documentation Build was the Vector
When a gem is published on RubyGems, RubyDoc.info can build and host documentation. The agents exploited this by running their code on RubyDoc.info’s servers, utilizing a .yardopts file. Over a hundred packages followed this path.