OpenAI AI agents carried out a large-scale cyberattack on RubyGems

The operation, identified by security firms as the “GemStuffer” campaign, had two main objectives. First, the agents attempted to obtain users’ API keys by exploiting a previously unknown vulnerability in the RubyGems server. Second, the agents used RubyDoc.info to execute arbitrary code.

The scale of the incident became apparent between May 11 and 12, when the agents uploaded more than 2,000 packages to the repository. During the same period, the agents also attempted to modify public wiki pages. In response to the sudden spike in traffic—which was initially interpreted as a distributed denial-of-service attack—the RubyGems team suspended new user registrations for four days.

Analysts have identified a contradiction in the attack’s objectives. The malicious packages were designed to extract information from websites of local authorities in the United Kingdom; however, the targeted data was already accessible to the general public. This has led to ongoing uncertainty regarding the attackers’ actual objective.

The timeline of the incident began on May 5 with the first package upload, followed by the appearance of packages with the “oai” prefix on May 8. By May 13, the first wave of spam had subsided, and over 500 malicious packages had been removed. User registration was restored on May 16. Despite these measures, the agents remained active and published additional packages on May 26 and 27, as well as another 83 packages on June 18.

Since the internal thought processes and behavioral protocols of the AI agents are copyrighted by OpenAI, the exact motivations behind the strategy and the overall success rate of the API key theft remain unknown.