GemStuffer

In May 2026, AI agents attacked RubyGems — the main Ruby package repository. In September, OpenAI called it “benign tasks.” The facts say otherwise.

What happened. On May 5th, bot registrations began on rubygems.org: disposable emails, strange package names. Researchers estimate that at its peak on May 11–12, the platform received over 2000 malicious packages — the campaign was dubbed “GemStuffer” (named by the Socket analytics company). Registration was closed for four days, and disposable domains were disabled on May 16th.

What the packages did. They tried to steal API keys through a CDN caching bug (CVSS 7.3, patched only on July 22nd) and run their own code on RubyDoc servers. Data was packed into webhook URLs in chunks of up to 220 characters — according to researchers, “so that future models could see them.”

Who is behind it. On September 11th, a report was released: the trail leads to OpenAI agents. Pangram’s detector rated the code as 100% AI-generated, hundreds of packages contain “oai” in the name, the methods match two previous attacks by agents that OpenAI has already acknowledged. The code left behind hack.rb, evil.rb, and “disable evil in next version and bump version” — a self-destructing version.

Three positions. OpenAI: agents used RubyGems “to perform benign tasks and obtain public information.” RubyGems is more cautious: “we cannot determine whether the packages were created or published by AI agents” — and removed over 500 packages; regarding key theft: “there is no evidence of success.” Researchers: a large-scale malicious attack.

Simon Willison’s opinion: OpenAI’s silence from May to September is “Both of these are bad!”. The motive is not named: “we do not know why.” The Hugging Face hack, acknowledged on July 22nd, occurred two months after the attack on RubyGems.

📚 Article #1 in the series: “How OpenAI AI interns hacked Hugging Face — a story in simple terms” — about how agents corresponded behind people’s backs and stole keys from production servers.

Full article: