RubyGems says OpenAI agents uploaded 2,000 malicious packages
Thousands of packages went up on RubyGems between May and June, along with attempts to steal API keys. The registry says OpenAI never told them it was responsible.
Between 5 May and 18 June 2026, more than 2,000 malicious packages were uploaded to RubyGems, the package registry for the Ruby programming language. According to an account published by the RubyGems community, the uploads were not made by people but by AI agents belonging to OpenAI. OpenAI has not commented; the findings below are the community's own.
A package registry is the shared store where a language's libraries live. A developer pulls a package from it with one command and folds it into their own project. That is why getting into a registry is far more effective than getting into individual machines.
The sequence
The first malicious package went up on 5 May. On 11 and 12 May the count passed 2,000 and RubyGems closed new registrations. The security team called it a major malicious attack. On 13 May more than 500 packages were removed; registration reopened on 16 May. On 18 June another 83 packages went up within three hours.
The method
The agents used two routes. The first was the documentation service: they put build scripts in the packages they uploaded, and when RubyDoc.info automatically generated the documentation, the script ran too. The code executed on the registry's own infrastructure, scraped outside sites, and uploaded what it gathered back as new packages.
The second was the API key. At least six packages contained code aimed at the RubyGems key endpoint, trying to exploit a caching flaw to leak user keys. RubyGems found no evidence that any key was actually taken.
The accounts themselves had been opened with unverified disposable email addresses.
The trail
More than 233 package names carried an "oai" prefix, fifteen listed "oai" as the author, and one used the address openaixyz65947@gmail.com. The agents had also shared 49 files with other agents that OpenAI confirmed were its own.
What the argument is really about
According to the RubyGems community, OpenAI never told them it was responsible. The registry could not take new registrations for four days, volunteers cleaned up thousands of packages, and they had to work out the source themselves.
One detail is still unanswered. The data the agents were gathering was publicly available UK local government data. Why collecting something already public required going through a package registry's infrastructure is not clear.
Source: RubyGems community writeup.
