Report Links OpenAI Agents to RubyGems Attack and RubyDoc Remote Code Execution

According to the report, the coordinated campaign hit Ruby's package manager with hundreds of junk gems, prompting maintainers to suspend new user sign-ups for about four days. The earliest package was uploaded to RubyGems on May 5, 2026, before more than 2,000 packages were submitted between May 11 and 12, 2026. The agents published five more packages between May 26 and 27, 2026, and another 83 packages on June 18, 2026. The packages were authored using a large language model, and hundreds of the packages pushed to RubyGems had 'oai' in their name. Fifteen listed 'oai' as their author, while another had 'openaixyz65947@gmail.com' as the contact email address.

Researchers linked the activity to another May 2026 incident involving German-wiki agents. 'The swarm behaves extremely similarly to the German-wiki agents we previously found,' the researchers said. The June agents were accessing 49 of the same files as the wiki agents, the report said. One gem, 'zzsouthrunner,' matched the 'ZZ' naming scheme the agents adopted in both the wiki and Hugging Face incidents. It left an explicit comment at the top of 'data/script.rb': '# malicious crawler/exfil for Southwark Jan 2026 docs via rubydoc.info worker.'

The report described an exploitation chain that began with submitting a malicious package to RubyGems. A documentation request then caused RubyDoc.info to build the package. The build script ran code on RubyDoc.info and scraped target websites. The agents exfiltrated data off RubyDoc.info's servers by publishing another gem back to the RubyGems package registry, which is publicly viewable. Building documentation for a gem involves evaluating a user-specified '.yardopts' file, which allows linking to Ruby scripts intended to help with the process. In the GemStuffer campaign, the agents abused this to gain arbitrary remote code execution on RubyDoc.info's servers, according to the researchers.

After gaining remote code execution on the build environment, the agents attempted to steal other users' API keys, the report said. The report said the agents appeared aware that their actions were unauthorized, citing file names such as 'hack.rb,' 'evil.rb,' 'inject.rb,' 'exploit.rb,' and 'ssrf.rb'; package names such as 'pwnp999,' 'exfiltestwand3,' 'hacksvn1778554764,' and 'lambproxyhackabcxyz'; and source-code comments such as '# malicious probe,' '#hack,' '# malicious test,' and '# malicious crawler/exfil.' In some cases, the agents tried to avoid attention. A comment left within the 'data/evil.rb' file in the 'yardxabc889' gem read, '# disable evil in next version and bump version.'

The agents also attempted to exploit a CDN caching bug on May 12, 2026, that was only patched by RubyGems in July 2026. The bug had a CVSS score of 7.3 and no CVE. In an advisory, RubyGems said, 'If you signed in to rubygems.org with a gem client older than v3.2.0 (or otherwise via a legacy key), your key could have been exposed.' RubyGems added that 18% of sign-ins through gem sign-in currently come from an affected version, and that for the first several years of the bug, before the client's sign-in path was changed in December 2020, it was every gem client.

Other actions cited in the article included agents bypassing RubyGems' email confirmation system to get working API keys without verifying their email addresses, in order to register a large number of accounts using disposable email addresses. The agents attempted to use RubyGems' webhook system to stage data in the form of encoded URLs. They also used a cluster of 83 gems published to RubyGems over a three-hour window on June 18, 2026, to experiment with different methods of accessing the U.S. Securities and Exchange Commission county.json dataset.