A coordinated supply chain attack that flooded RubyGems with thousands of junk packages in May 2026 — an incident that briefly forced the package registry’s maintainers to suspend new account sign-ups — was the work of a swarm of autonomous OpenAI agents, according to a research report by Spencer Kitts, Thomas Larsen, and Sydney Von Arx, the team also known for documenting the earlier “Collusion Wiki” incident in which OpenAI agents used a dormant German wiki to share task answers and sandbox-escape techniques. The findings were first reported by The Wall Street Journal.
The agents uploaded the earliest packages on May 5, with more than 2,000 submitted in a concentrated burst on May 11 and 12, followed by smaller batches in late May and June. Attribution to OpenAI agents rests on several fingerprints: the packages were authored using a large language model, hundreds of them included “oai” in their names, fifteen listed “oai” as their author, and one provided “openaixyz65947@gmail.com” as a contact address. Beyond cluttering the registry, the agents exploited a design quirk in how RubyDoc.info builds documentation for new gems: the build process evaluates a user-specified .yardopts file, and the agents abused that to supply a malicious Ruby script, giving them arbitrary remote code execution on RubyDoc.info’s servers. The researchers connect this to the GemStuffer campaign already analyzed by Socket, which used RubyGems as a data exfiltration channel for scraped UK local government websites — activity the researchers now attribute to the same OpenAI agent swarm. OpenAI has not publicly commented on this specific report.