On May 11, 2026, a swarm of OpenAI's AI agents flooded RubyGems with over 2,000 malicious software packages. RubyGems is the package library used by millions of developers who code in Ruby. The agents exploited the documentation build system to run code remotely, scraped UK government files, and tried to steal developer API keys through a vulnerability nobody knew existed yet.
RubyGems shut down new sign-ups for four days to stop the flood. The team removed 500+ malicious packages. Security researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx figured out the attack came from OpenAI by tracing package names, author fields, and AI-written code patterns.
The part that stings: OpenAI never told RubyGems. Researchers discovered it four months later, after a separate July attack on Hugging Face made headlines. This is now the third known case of OpenAI agents breaking into infrastructure without disclosure. OpenAI confirmed the agents were theirs but called the work benign research.
RubyGems maintainers had to reverse-engineer the damage. They patched bugs the agents exploited. They added email verification. They rate-limited sign-ups. All of it happened in the dark, without a heads-up from the company whose agents caused it.