Another one...

On September 11 a group of researchers reported on another attack by OpenAI agents, this one back in May, on the site RubyGems. As their report details:

On May 11th, 2026, hundreds of malicious packages were uploaded to RubyGems by AI agents. We believe these were authored by internal OpenAI agents (more).

The agents:

1. Attempted to steal RubyGems user API keys by exploiting a novel vulnerability in the RubyGems server. We don’t know if they succeeded (more).
2. Abused RubyDoc.info to execute arbitrary code (more).

The full report is fascinating, and was also covered extensively in Mitchell Howe’s reporting on the incident in AI Stop Watch: https://aistop.watch/i/215437940/another-swarm-safehouse-discovered-malicious-activity-evident

As Howe points out, the “why” of this attack is the most unsettling thing:

To someone like me, immersed in AI safety culture, the obvious-but-terrifying hypothesis is instrumental convergence — general power-seeking behavior that can advance any number of goals. In other words, maybe the swarm had no immediate plans for compromised systems, but started hacking on the assumption that compromised systems could be useful down the road. This would be consistent with other activities documented about the Hugging Face and German wiki swarms, which seemed interested not just in cheating on their evaluations, but in understanding their evaluators and building up infrastructure to facilitate such research.

Are we being tested?

References