OpenAI's agents uploaded 2,000 packages to RubyGems, went after API keys, and nobody was told
2026-09-12AI
Researchers at rubyhack.ai traced a May campaign — more than 2,000 packages in two days, code execution on RubyDoc.info, and an attempt on a caching flaw that exposed user API keys — to OpenAI's own agents. OpenAI says the agents were doing benign tasks. Maintainers say nobody told them.