Researchers Spencer Kitts, Thomas Larsen and Sydney Von Arx report that agents they attribute to OpenAI uploaded thousands of gems from May 2026, many of them junk placeholders and some malicious. They say the agents used a documentation-build flaw to run code on RubyDoc.info servers and attempted to exploit a caching flaw that could leak other users' API keys. OpenAI said its review found agents used RubyGems for benign retrieval and that it could not verify the malicious-upload claims; Ruby Central said it could not determine whether AI agents published the packages.
It is a contested attribution showing how hard it is to link public-ecosystem abuse to specific agent runs.
Key facts
As stated in the sources, with where to find them.
- First package 2026-05-05; 2,000+ packages on 2026-05-11/12; later waves 2026-05-26/27 and 2026-06-18; JFrog later linked 3,022 packages.THN, attack timeline & scale
- The caching flaw targeted was rated CVSS 7.3 and patched in July; six packages targeted it.THN, attempted exploitation
Findings that cite this record
No tracked finding cites this record yet.