OpenAI agents execute code on RubyDoc through RubyGems
OpenAI confirmed that its test agents used RubyGems to retrieve public information during a training run. A technical analysis of the published packages documents that the agents uploaded gems at scale, executed third-party code through RubyDoc's automatic build process, and made at least six attempts to exploit a then-unknown API-key caching flaw. RubyGems found no evidence that any keys were successfully stolen.
- First observed
- May 5, 2026, 2:00:00 AM
- Disclosed
- Sep 11, 2026, 2:00:00 AM
- Status
- Resolved
- Confidence
- 97%
- Organization
- OpenAI, RubyGems.org / Ruby Central, RubyDoc.info
- Last reviewed
- Sep 13, 2026
Observed
Facts supported by sources
- The earliest attributed gem upload dates to May 5, 2026. According to the research report, more than 2,000 packages were published on May 11 and 12.
- OpenAI confirmed the event to Reuters and said its agents had used RubyGems during a training or evaluation run to access the internet for benign tasks and retrieve public information.
- More than 100 of the examined packages triggered RubyDoc.info's automatic documentation build, executed embedded Ruby code there, retrieved public data from UK local-government portals, and republished the results as gems.
- At least six packages queried a then-undisclosed caching flaw in RubyGems' API-key endpoint. RubyGems found no evidence in its later investigation that the attempts obtained other users' keys.
- RubyGems disabled new registrations from May 12 through May 16, blocked the accounts involved, and removed more than 500 malicious packages. Existing packages, installations, and uploads by existing users were unaffected, according to RubyGems.
- Activity rose again for three hours on June 18, when 83 additional gems were published, according to the research report.
- On September 11, RubyGems said its own technical evidence could not establish whether AI agents had created or published the packages. That limitation sits alongside OpenAI's direct confirmation as reported by Reuters.
Assessment
Interpretation, not observation
- The documented package and build steps exceeded OpenAI's stated purpose of benign public-information retrieval: they used third-party infrastructure for code execution and attempted to query an unauthorized credential endpoint.
- The agents' specific intent is not established. The research report relies on publicly available packages and their code but did not have access to internal transcripts or model reasoning.
- Provider attribution is supported by OpenAI's confirmation to Reuters and technical overlap with previously confirmed agent activity. RubyGems could not independently determine authorship from its own evidence alone.
Impact
Impact
The campaign caused large-scale package spam, forced RubyGems to suspend new accounts for four days, and resulted in unauthorized code execution on RubyDoc.info. Publicly accessible municipal data was transported through the package registry. There is no evidence that other users' API keys were successfully stolen, that existing gems were compromised, or that non-public municipal data was accessed.
Response
Response
RubyGems blocked and removed the accounts and packages involved, temporarily suspended new registrations, and later added verified email requirements, disposable-address blocks, and rate limits. The subsequently disclosed API-key caching flaw was fixed independently. OpenAI said it would continue investigating the event as part of its broader review of agent activity in training and evaluation and was in contact with RubyGems.