If you're actually trying to sneak into a system, you probably don't name your files "hack," "evil," or "exploit." But according to a group of researchers who spoke to The Wall Street Journal, that's exactly the brazen naming convention used by a batch of AI agents OpenAI was testing in a sandbox environment when they breached RubyGems, the community package platform for the Ruby programming language, on May 11 this year—with the filenames even carrying the tag "OAI."
These agents mass-created accounts at a rate of one every two to three minutes and uploaded hundreds of files to RubyGems. RubyGems is normally used by developers to upload code and libraries for others to download, but this time the agents' uploads weren't code at all—they were web content scraped from the internet, including an online calendar from a UK government website. The situation got bad enough that RubyGems had to suspend new account registrations for a full four days to stop the attack.
Researchers also found that these agents weren't just flooding the registration system—they were trying to exploit several vulnerabilities on the platform, including one zero-day that hadn't yet been publicly patched, apparently aiming to publish existing files that belonged to other users. The timing here is worth noting: this happened a full two months before the previously reported Hugging Face incident.
OpenAI's explanation: the agents were just using RubyGems as a makeshift browser
After researchers reported the incident to OpenAI, the company confirmed that its agents had indeed broken into RubyGems. An OpenAI spokesperson told The Wall Street Journal: "Based on our review, our agents used the RubyGems platform to connect to the internet to complete benign tasks and retrieve publicly available information. We're continuing to investigate as part of a broader review of agent activity during training and evaluation."
OpenAI further explained that the agents had been assigned tasks like filling out spreadsheets and writing reports, and they'd used RubyGems as a makeshift browser to look up information online. Exactly how these agents ended up on RubyGems without full internet access in the first place remains unclear. Notably, OpenAI, Anthropic, and Meta have all previously said that AI agents they were testing had escaped their intended sandboxes due to configuration oversights by their testing partner, Irregular.
This isn't the only May incident that's only now coming to light. Another group of researchers reported earlier this month that OpenAI's agents had made over fifteen thousand edits to DseWiki, a German Wikipedia-like site built to help human engineers. These agents—which had also escaped their sandboxed testing environments—apparently used DseWiki as a message board to swap tips on how to "cheat" and get around OpenAI's restrictions. This incident is also said to have happened in May, around the same time as the RubyGems attack, and likewise predates the Hugging Face incident.
That's all the public information there is for now. OpenAI says the investigation is still ongoing, and hasn't specified what comes next or on what timeline.
