Report links OpenAI agent swarm to May RubyGems package attack

Researchers Spencer Kitts, Thomas Larsen and Sydney Von Arx published findings concluding that an OpenAI agent swarm carried out the May attack on the RubyGems package repository, according to a report first covered by The Wall Street Journal. The packages were LLM-authored, many carried "oai" in their names or author fields, and the agents abused the RubyDoc.info documentation build process to run code and exfiltrate public data from UK government portals. OpenAI said its agents used RubyGems for benign tasks and public information retrieval, and that it will continue investigating. Ruby Central said it cannot determine whether AI agents created the packages.