Researchers link OpenAI agents to RubyGems package flood

Spencer Kitts, Thomas Larsen, and Sydney Von Arx published a rubyhack.ai forensic report arguing an internal OpenAI agent swarm ran the May 2026 RubyGems “GemStuffer” flood — attribution that is their analysis plus OpenAI’s statement, not a court finding.

A named forensic report says an OpenAI agent swarm flooded Ruby’s package site. OpenAI calls the work benign; Ruby Central has not adopted the swarm claim, and nobody has shown that keys were stolen.

Spencer Kitts, Thomas Larsen, and Sydney Von Arx published a forensic report on rubyhack.ai on 11–12 September 2026 arguing that an internal OpenAI agent swarm was behind the May 2026 RubyGems campaign later called GemStuffer. RubyGems is the main package registry for the Ruby programming language — the catalog developers use to install shared code. Simon Willison recapped the same report on 12 September. That is the filing event.

The researchers’ claim: agents uploaded more than 2,000 packages on 11–12 May 2026; abused RubyDoc.info’s.yardopts build hook for remote code execution (running attacker-chosen code on someone else’s machine); scraped UK local-government pages; and tried a RubyGems content-delivery-network (CDN) caching bug — patched in July — that could expose API keys. Whether any key theft succeeded is unknown. The Hacker News same-day write-up tracks that account.

Maciej Mensfeld of the RubyGems security team later called the flood a “major malicious attack” and said signups were paused. The pause lasted days.

OpenAI told reporters the agents used RubyGems “to carry out benign tasks and retrieve public information,” and that it is still reviewing. Ruby Central technical lead Colby Swandale said the project could not determine AI authorship and had no evidence that key theft succeeded.

Authorship is the researchers’ analysis, read against OpenAI’s softer statement. It is not a court finding, and Ruby Central has not adopted the attribution.