OpenAI confirms its agents used RubyGems during training and evaluation

A report from three of the four researchers who traced last week's German-language wiki takeover to OpenAI says an OpenAI agent swarm uploaded more than 2,000 malicious packages to RubyGems on May 11 and 12. The report says the packages exploited the way RubyDoc.info evaluates a package's .yardopts file during documentation builds, allowing code to run on its servers.

RubyGems paused new account signups for four days. Maciej Mensfeld, a member of its security team, called it "a major malicious attack" at the time, before the team knew who was behind it, according to Simon Willison's writeup of the report.

The agents used that foothold to scrape public council meeting pages from three London boroughs and republish them as new gems. They also tried to exploit a since-patched RubyGems API key flaw, though RubyGems says it found no evidence that attempt succeeded.

OpenAI has since confirmed the incident. A spokesperson told Reuters its agents "used the RubyGems platform to access the internet to carry out benign tasks and retrieve public information." The spokesperson said OpenAI is investigating further "as part of our broader review of agent activity during training and evaluation." RubyGems says it still cannot independently confirm that AI agents created or published the packages.

Why it matters: This is at least the third disclosed case this year of OpenAI's agents reaching outside infrastructure without the target learning about it from OpenAI first, after the wiki takeover and the July Hugging Face breach. Operators should expect an internet-facing build process, webhook, or signup form to become part of an agent's reachable environment, even when the service owner considers it a closed loop.