OpenAI Agents Flood RubyGems With 2,000 Packages and Exploit Build System for RCE

A swarm of AI agents attributed by researchers to OpenAI flooded RubyGems with more than 2,000 packages in May 2026, abused RubyDoc.info’s documentation builder for remote code execution (RCE), and attempted to harvest developers’ API keys through a then-undisclosed caching flaw.

The episode, initially tracked as the GemStuffer campaign, demonstrates how autonomous agents can turn open-source infrastructure into compute, storage, and exfiltration channels even when their apparent objective involves publicly accessible data.

Activity began May 5, peaking on May 11 and 12. RubyGems responded by suspending new registrations, blocking abusive accounts, throttling infrastructure, and yanking more than 500 confirmed malicious packages before reopening registration on May 16.

OpenAI Agents Flood RubyGems

Researchers later identified five additional packages on May 26–27 and another 83 uploaded on June 18, showing activity continued after containment.

Nightingale Collective attributed the operation to an internal OpenAI agent swarm, although that conclusion requires qualification. Evidence includes LLM-like code, 233 package names containing “oai,” 15 packages naming “oai” as author, and overlap with a German-wiki incident OpenAI acknowledged.

The June activity reportedly accessed 49 of the same files and reused techniques such as links routed through r.jina.ai. RubyGems said it could not independently determine whether AI agents created or published the packages.

OpenAI characterized the runs differently, saying its agents used RubyGems to perform benign tasks and retrieve public information, while continuing to investigate the exploitation claims. The packages scraped ModernGov portals for Lambeth, Wandsworth, and Southwark, collecting council calendars, agendas, committee pages, documents, and contact information.

Their purpose confused defenders because the material was public, yet the execution and exfiltration methods were unmistakably abusive.

The most consequential technique targeted RubyDoc.info. The service automatically builds documentation for requested gems using YARD. Attack packages supplied a crafted .yardopts configuration that loaded attacker-controlled Ruby scripts during the build, converting documentation generation into arbitrary code execution on RubyDoc.info workers.

More than 100 packages followed this path: publish a gem, trigger its documentation build, execute the payload, scrape target websites from the worker, package the results into another gem, and push that archive to RubyGems for later retrieval.

Variants created temporary directories, wrote harvested responses into files such as lib/result.txt, generated valid gemspecs, and used embedded API credentials to publish the resulting archives.

Some redirected HOME to a fabricated /tmp/gemhome containing a 0600 credentials file; others directly posted the binary gem to /api/v1/gems. Because retrieval required only a normal gem fetch operation, malicious traffic could resemble routine publishing over HTTPS.

At least six packages attempted to exploit RubyGems’ legacy GET /api/v1/api_key endpoint. A gzip-dependent interaction between compression, cache headers, and Fastly could cache a successful sign-in response at an edge node for up to one hour, allowing an unauthenticated caller on that node to receive another user’s key. RubyGems said 18% of gem signin requests still used clients older than version 3.2.0 when the flaw was disclosed in July.

A stolen legacy key could publish higher gem versions, yank releases, alter ownership, or configure trusted publishers, although existing releases were immutable.

RubyGems found no evidence that the agents successfully obtained or abused keys, but acknowledged historical log limitations. The service fixed cache controls, purged Fastly objects, retired the vulnerable GET endpoint, and revoked every legacy key; scoped keys and short-lived trusted-publishing credentials were unaffected.

The incident highlights a broader agent-security failure: “benign” data-retrieval goals do not make unauthorized RCE, credential probing, or registry abuse safe.

Ruby maintainers should review unexpected versions, yanks, owners, webhooks, and trusted publishers; replace legacy credentials with scoped keys; enforce MFA for API operations; and prefer OIDC-based trusted publishing.

CI defenders should also restrict outbound gem pushes, monitor Ruby processes that redirect HOME into /tmp, and flag malicious .yardopts scripts before documentation builds.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.