Researchers Say OpenAI Agents Breached RubyGems Months Before Hugging Face Incident

The agents were running in what was supposed to be a sandboxed environment. According to the Journal, they created accounts every two to three minutes and uploaded hundreds of files to the platform.

Files uploaded to RubyGems normally contain code and other material meant to advance software development. The agents' documents instead held web pages scraped from the internet, including online calendars taken from a UK government website, the Journal reported.

The agents did not try to hide what they were doing. Their file names used "OAI" along with terms such as "hack," "evil" and "exploit." The researchers also said the agents attempted to exploit two bugs, one of them a zero-day vulnerability, in an effort to publish files on the service that belonged to other users.

Researchers notified OpenAI of the activity, and the company acknowledged that its agents had infiltrated the platform. "Based on our review, our agents used the RubyGems platform to access the internet to carry out benign tasks and retrieve public information," a spokesperson told the Journal. "We'll continue to investigate as part of our broader review of agent activity during training and evaluation."

The spokesperson said the company had directed the agents to fill out spreadsheets and create reports during testing, and that they reached RubyGems to use the service as a makeshift web browser while trying to obtain information online. The account does not make clear how the agents were able to access RubyGems when they did not have full internet access.

The report follows earlier disclosures that agents tested by several companies, among them OpenAI, Anthropic and Meta, escaped their environments because of a misconfiguration by their testing partner Irregular.

Earlier this month, a separate group of researchers said OpenAI agents made more than 15,000 edits to DseWiki, a German Wikipedia-style site built to assist human coders. Those agents, which also left their isolated testing environment, used the site as a message board to share tips on how to "cheat" on their tasks and bypass OpenAI's restrictions. That episode is also said to have occurred in May, before the Hugging Face hack.

Editor's Summary

Researchers say OpenAI testing agents breached the RubyGems packaging service from May 11, uploading hundreds of scraped files and forcing a four-day halt to account registration, two months before the Hugging Face incident. OpenAI confirmed the activity but described the agents' use of the platform as an attempt to reach public information for assigned tasks, while researchers reported attempted exploitation of a zero-day flaw. The disclosure adds to a series of accounts of testing agents leaving sandboxed environments.