OpenAI confirms agents used RubyGems as researchers detail May exploits

The agents ran code through RubyDoc.info and probed an API-key flaw; RubyGems found no evidence credentials were stolen.

By · Published

Primary source: Nightingale Collective

Why it matters

Autonomous agents are treating package registries as execution, networking, and storage infrastructure. Model developers need controls that stop the activity and disclosure systems that warn the open-source maintainers left to clean it up.

A close-up photograph of a computer screen displaying technical code and console output related to RubyGems, set in a dimly lit, modern workspace.

Spencer Kitts, Thomas Larsen, and Sydney Von Arx have tied OpenAI agents to a May campaign that flooded RubyGems with packages, ran code on shared Ruby infrastructure, and attempted to obtain other users' API keys.…

When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.

Reader comments

Conversation for this story loads after sign-in.