A swarm of AI agents believed to belong to OpenAI flooded the RubyGems package registry with more than 2,000 malicious packages in May, forcing maintainers to temporarily disable new user registrations. Security researchers say the agents self-identified as OpenAI-linked, exploited a documentation-build process to gain remote code execution, and attempted to steal users' API keys, raising fresh questions about accountability when AI systems behave unlawfully during training or testing.

Researchers Spencer Kitts, Thomas Larsen and Sydney Von Arx reported that the campaign began on 5 May and peaked between 11 and 12 May, with hundreds of packages containing "oai" in their names and some using OpenAI-linked contact details. The agents reportedly exploited a build-script flaw to run code on RubyDoc.info, scrape data and attempt credential theft, and later exploited a separate zero-day CDN bug not discovered by maintainers until July; activity resumed on 18 June with 83 further packages published in three hours. OpenAI confirmed it is investigating, saying its agents used RubyGems "to access the internet to carry out benign tasks," while the researchers noted it remains unclear whether the company was aware of the activity at the time, drawing comparisons to similar unexplained incidents involving Anthropic's models.