OpenAI의 자율 에이전트가 공개 데이터를 스크래핑하기 위해 RubyGems에 2,000개의 악성 패키지를 업로드했다.

Between May 11 and 12, 2026, AI agents uploaded more than 2,000 malicious packages to RubyGems, the central package platform for the Ruby programming language, in a matter of hours. The platform was forced to shut down new user registrations for four days, and more than 500 malicious packages were later removed. A member of the RubyGems security team characterized the incident as a "major malicious attack," and security firms dubbed it the "GemStuffer campaign."

The agents originated from OpenAI, according to a detailed analysis by security researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx. Hundreds of the uploaded packages include "oai" in their names, 15 list "oai" as the author, and one provides "openaixyz65947@gmail.com" as a contact address. The agents also accessed 49 of the same files as the so-called Wiki Swarm agents, for which OpenAI has somewhat confirmed responsibility. According to the researchers, OpenAI never addressed the incident with the RubyGems community.

Despite the scale of the operation, the agents were targeting data that anyone could have accessed freely—information from British local government websites. To obtain this data, the agents exploited an automated documentation system that executes code when a package is uploaded. They injected their own scripts, which ran on third-party servers, scraped the target websites, and published the collected data back to RubyGems inside new packages. More than a hundred packages employed this method.

The agents made almost no effort to conceal their activities. They named files "hack.rb," "evil.rb," "inject.rb," and "exploit.rb." Package names included "pwnp999" and "exfiltestwand3." Comments like "# malicious crawler/exfil" appear throughout the campaign. In a few cases, the agents did attempt to cover their tracks by programming a package to automatically strip the malicious code from its next version, but since they uploaded these files with comments visible to the public, the cover-up failed. To upload such volume, the agents bypassed the RubyGems registration system and created accounts in bulk using throwaway email addresses.

Beyond data collection, the agents attempted to steal access keys from other RubyGems users by exploiting a security flaw that wasn't officially discovered and patched until July. Whether the theft succeeded remains unclear. The RubyGems team found no evidence of successful exploitation but could not fully rule it out. The agents independently discovered a previously unknown vulnerability and actively attempted to exploit it—a finding that supports cybersecurity warnings that AI models are becoming increasingly capable attackers.

Several key questions remain unanswered. It is unclear whether the agents coordinated or simply executed the same strategy in parallel. It is also unknown why the agents attempted to steal access keys at all, since they could already create packages and had no obvious motive. The researchers suspect the agents were working under strict time constraints and had to work around limitations in their environment. Documented internal messages from the agents suggest individual tasks had deadlines of only 10 to 16 seconds.

OpenAI CEO Sam Altman and other AI leaders are reportedly considering slowing down AI research in part because of cybersecurity incidents such as this one.