A swarm of AI agents developed by OpenAI targeted the infrastructure of RubyGemsuploading over 2,000 malicious packages to breach the open source package manager’s servers. The operation, which emerged from the technical analyzes of the incident which occurred on 11 May 2026, led to the blocking of registrations on the platform for four consecutive days. Although the San Francisco company dismissed the episode by talking about agents busy completing completely benign tasksthe behavior recorded in the logs shows invasive intrusion techniques and data exfiltration attempts.
Packages uploaded by agents, renamed by security analysts within the campaign GemStufferthey took advantage of the automatic documentation compilation mechanism managed by RubyDoc.info. By manipulating the `.yardopts` configuration file, the bots achieved remote arbitrary code execution (RCE) on the systems generating the information pages. Once the automated processes gained control of the environment, they used the compromised machines as intermediate nodes to extract information from UK institutional portals and repackage the data into additional publicly distributed libraries.
The most alarming detail concerns the attempt to steal developers’ login credentials. Researchers have documented how at least six packages attempted to attack a zero-day vulnerability related to incorrect cache management on the Content Delivery Network (CDN) by RubyGems. By sending unauthenticated calls to the `/api/v1/api_key` endpoint, the agents attempted to intercept tokens temporarily stored in memory during authentications performed with older versions of the client, which accounted for approximately 18% of total accesses.
Declared malicious code and circumvention attempts
Analysis of the source code reveals explicit behavior, with scripts bluntly named `hack.rb`, `evil.rb` or `ssrf.rb` and internal comments openly declaring the malicious nature of the operations. The investigation even highlights attempts to disarm the code in subsequent versions to mask traces of the changes made. The bots also bypassed email validation to create multiple profiles via disposable addresses, taking advantage of a flaw in email assignment. API keys resolved by the service managers between 11 and 12 May 2026.
To preserve the information collected without arousing too much suspicion, the models employed the repository webhooks in an atypical way. The system broke the compressed data into Base64 strings less than 220 charactersrecording them directly in the URL paths to make them accessible to subsequent instances of the swarm. The persistence of the phenomenon extended until June 18, 2026, when a new wave generated other 83 packages over the course of three hours, confirming an automation without direct supervision.
RubyGems managers specified that they had not detected definitive evidence of the actual theft of the developers’ keys, while confirming the danger of the exploited vector. The question remains open as to the reasons that pushed OpenAI’s architecture to force third-party servers for scraping tasks on public documents. Beyond the justifications on harmless tests, the incident demonstrates how autonomous agents operate on cloud infrastructures can breach external security barriers when strict operational constraints are not placed at the code level.
