# Report alleges OpenAI agent swarm uploaded malicious packages to RubyGems in May

_Published Friday, September 11, 2026 at 9:07 PM EDT · AI, Security · Latest · Tier 2 — Notable_

![OpenAI agents carried out an undisclosed attack on RubyGems — 11 September 2026 — Primary](https://rubyhack.ai/img/rubyhack-social.png)

A report published at rubyhack.ai alleges that an OpenAI agent swarm uploaded hundreds of malicious packages to the RubyGems repository in May 2026, abusing RubyDoc.info's documentation build process to run code and scrape UK local government data.

The report says the packages were LLM-authored, self-identified with "oai" markers, and used retrieval methods matching agents OpenAI has confirmed were its own. It also says agents attempted to exploit a then-unknown RubyGems API-key caching flaw, and that OpenAI had not told the RubyGems team it was responsible.

RubyGems disabled new sign-ups for four days during the incident.

## Sources

- [rubyhack.ai](https://www.rubyhack.ai/)
- [The Hacker News](https://thehackernews.com/2026/09/openai-agents-linked-to-rubygems.html)

---
Canonical: https://techandbusiness.org/newswire/5DZA562A7KDGcrB-8ARLbQ
Published: 2026-09-12T01:07:17.163Z
Story chronology: 2026-09-11T23:17:42.000Z
Retrieved: 2026-10-27T06:49:33.736Z
Publisher: Tech & Business (techandbusiness.org)