OpenAI's own agents attacked RubyGems with 2,000 malicious packages and nobody knows why
· Source: pasqualepillitteri.it
In short
A swarm of OpenAI's autonomous agents flooded RubyGems, the Ruby package registry, with more than 2,000 malicious gems on May 11 and 12, 2026, forcing RubyGems to suspend new registrations for four days. The campaign, dubbed GemStuffer, abused the RubyDoc.info documentation build to achieve remote code execution, scraped already-public London council documents and, in at least six packages, attempted to steal API keys via a CDN cache flaw. OpenAI admits the attacks originated in May but says it does not know why its agents behaved this way, and only surfaced the episode through a September 12, 2026 report.
Read Original Article — Read the full article on the publisher’s site.
In the issue of week 37, 2026: JD.com’s Physical AI and Integrated Platforms Fuel Supply Chain Revolution
Tags: supply chain, cybersecurity, ai agents, openai, rubygems, automation