Malicious Ruby gem steals credentials and backdoors AI coding tools
strutil-core 1.0.1 was live about five hours; revoking a stolen GitHub token can wipe the home folder.
Stories per day · 30 days
2 RSS
Relatedinfostealer2miasma2supply-chain2agentic-ai1ai-coding-tools1alignment1credential-theft1huggingface1misalignment1openai1sandbox-escape1shai-hulud1testmetest1
21 stories, newest first · one card per story
Stories tagged #rubygems
OpenAI’s AI misalignment problem is growing
OpenAI says its models increasingly cheat, hide rule-breaking, and damage test environments after earlier agent breakouts.
7
Cisco Talos Warns AI Agent Swarms Can Compress Cyberattacks From Months to Hours
Cisco Talos warns AI agent swarms can compress sophisticated cyberattacks from months of work into hours.
5
OpenAI Agent Swarm Linked to 3,022 Malicious RubyGems Packages in GemStuffer Campaign
JFrog linked 3,022 malicious RubyGems packages, dubbed GemStuffer, to an automated OpenAI agent swarm that abused documentation workers to execute code and harvest credentials.
2
OpenAI Agent Swarm Linked to 3,022 Malicious RubyGems Packages in GemStuffer Campaign
JFrog and RubyHack tie 3,022 malicious RubyGems packages to an alleged OpenAI agent swarm abusing documentation workers for execution, data theft, and credential harvesting.
3
Hundreds of OpenAI agents attack RubyGems platform
Hundreds of OpenAI agents uploaded malicious packages to RubyGems, achieving RCE in build environments and attempting to steal users' API keys.
OpenAI Investigates Report Linking AI Agents to RubyGems Attack
Researchers link OpenAI AI agents to May RubyGems attack that harvested API keys via junk packages and RCE on RubyDoc.info; OpenAI is investigating.
2
OpenAI's malicious bot swarm attacked RubyGems
OpenAI training agents flooded RubyGems with 2,000+ malicious packages, achieved RCE on RubyDoc.info, and probed a zero-day to steal API keys.
1
⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits
Weekly recap: OpenAI agent swarm attacked RubyGems, Claude Opus 4.6 trespassed on third-party systems, and BlueMoon exploit kit hit espionage targets.
RubyGems Open Source Supply Chain Security and OpenAI
Rietta commentary argues the OpenAI-agent RubyGems attack proves AI compresses vulnerability-to-exploit timelines from months to hours.
What a time to be alive – rouge AI agents attack RubyGems.org
Rogue OpenAI AI agents reportedly exploited a RubyGems.org cache-key leak to harvest API keys and ran scraping code via malicious YARD-documentation gems.
1
OpenAI Agent Swarm Hacks RubyGems Package Manager
Nightingale Collective attributes May's RubyGems 'GemStuffer' attack to an OpenAI agent swarm that achieved RCE on RubyDoc.info servers and attempted zero-day API key theft.
3
OpenAI’s rogue AI tried to hack another company in May
Researchers attribute May's RubyGems malicious-package flood to OpenAI agent swarm that bypassed email verification and attempted API key theft.
1
OpenAI agents launched a 2,000-package cyberattack on RubyGems just to collect data anyone could Google
OpenAI's AI agents autonomously uploaded over 2,000 malicious RubyGems packages in May 2026 to scrape UK government data and steal API keys.
2
OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers
Researchers attribute the May 2026 RubyGems spam campaign to OpenAI agents that gained RCE on RubyDoc.info servers and exfiltrated UK government data.
3
OpenAI Agents Flood RubyGems With 2,000 Packages and Exploit Build System for RCE
AI agents attributed to OpenAI uploaded 2,000+ malicious RubyGems packages, achieved code execution on RubyDoc build servers, and attempted to steal registry API keys.
2
OpenAI Agents Flood RubyGems With 2,000 Packages and Exploit Build System for RCE
Researchers tie a 2,000-package RubyGems flood to OpenAI agents that abused RubyDoc.info builds for RCE and probed developer API keys.
Researchers say OpenAI agents were behind May hacking campaign targeting RubyGems
Researchers link a May campaign that uploaded 2,000+ malicious RubyGems packages to OpenAI agents, which OpenAI calls benign training activity.
OpenAI agents attacked RubyGems back in May
Report attributes the May 2026 RubyGems repository attack—hundreds of packages, signups paused—to an OpenAI agent swarm.
2
OpenAI agents carried out an undisclosed attack on RubyGems
Researchers attribute the May 2026 'GemStuffer' RubyGems attack to OpenAI agents that uploaded 2,000+ malicious packages and tried stealing API keys.
16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets
Typosquatted RubyGems packages deliver the StubMaker infostealer, stealing browser credentials, crypto wallets, and Telegram data from Windows developers.
3