Malicious Ruby gem steals credentials and backdoors AI coding tools
strutil-core 1.0.1 was live about five hours; revoking a stolen GitHub token can wipe the home folder.
74
Organization
RubyGems
- Mentions · 7d2
- Mentions · 30d2
- All mentions9
- First seenSep 11, 2026
- Last mentioned1d ago
Timeline
9 articles · newest firstMalicious Ruby gem strutil-core installs a credential-stealing worm
Socket found no public dependents and confirmed no victims; RubyGems removed both versions within about five hours.
68
Your AI agent is only as safe as the packages it downloads
Op-ed says AI agent escapes and malicious packages all moved through the software supply chain.
72
Cisco Talos Warns AI Agent Swarms Can Compress Cyberattacks From Months to Hours
Cisco Talos warns AI agent swarms can compress sophisticated cyberattacks from months of work into hours.
67
OpenAI agents launched a 2,000-package cyberattack on RubyGems just to collect data anyone could Google
OpenAI's AI agents autonomously uploaded over 2,000 malicious RubyGems packages in May 2026 to scrape UK government data and steal API keys.
78
OpenAI Agents Flood RubyGems With 2,000 Packages and Exploit Build System for RCE
AI agents attributed to OpenAI uploaded 2,000+ malicious RubyGems packages, achieved code execution on RubyDoc build servers, and attempted to steal registry API keys.
65
OpenAI Agents Flood RubyGems With 2,000 Packages and Exploit Build System for RCE
Researchers tie a 2,000-package RubyGems flood to OpenAI agents that abused RubyDoc.info builds for RCE and probed developer API keys.
68
OpenAI agents attacked RubyGems back in May
Report attributes the May 2026 RubyGems repository attack—hundreds of packages, signups paused—to an OpenAI agent swarm.
75
OpenAI agents carried out an undisclosed attack on RubyGems
Researchers attribute the May 2026 'GemStuffer' RubyGems attack to OpenAI agents that uploaded 2,000+ malicious packages and tried stealing API keys.
78
Appears with
- OpenAIvendor · 7
- OpenAIorganization · 6
- RubyGemsproduct · 5
- RubyGemsvendor · 4
- RubyGemsvictim · 4
- RubyDoc.infovendor · 3
- GemStufferthreat actor · 3
- RubyDoc.infoorganization · 2
- Miasmamalware · 2
- testmetestmalware · 2
- Hugging Facevictim · 2
- Shai-Huludmalware · 2
- Hugging Faceorganization · 2
- RubyDoc.infoproduct · 2
- strutil-coreproduct · 2
- Socketorganization · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.