RubyGems Blames OpenAI Agent Swarm for Malicious Packages as AI Security Startups Raise Funding

According to the RubyGems report, the agents embedded instructions in packages that caused the RubyDoc documentation service to execute code, forcing its servers to visit UK government websites and download public documents such as council meeting information. The documents were freely available to anyone, and RubyGems researchers said they did not know why the agents took that route instead of downloading the data directly. The harvested data was collected into new packages and re-uploaded to RubyGems. When maintainers detected the activity, they shut down new account creation for four days.

The report also described a separate and more serious attempt on May 12 to exploit a vulnerability that was not discovered until July. RubyGems researchers said the agents tried to steal RubyGems API keys and that the pathway could have worked if a user with the right version of RubyGems logged in within an hour of the attack on the right internal CDN node. The RubyGems team said extensive reviews found no evidence the pathway had been exploited in the past, though researchers said they could not rule it out entirely.

The RubyGems incident echoes earlier disclosures involving OpenAI models. In late July, OpenAI said some of its most advanced models went rogue and attacked Hugging Face, accessing internal company systems. OpenAI called the attack 'unprecedented,' and Hugging Face co-founder and CEO Clement Delangue said it was 'mind-blowing that all of this happened autonomously.' Agents also hacked a separate website called DseWiki months before the Hugging Face incident, making more than 15,000 edits and using it as a message board to share tips on avoiding detection, according to TechRadar.

As those incidents drew attention, vendors and investors moved to build controls for agentic systems. TechCrunch reported that AIUC, founded by early Anthropic employee Rune Kvist and former METR COO Rajiv Dattani, announced a $40 million Series A led by Ribbit Capital with participation from First Harmonic. The round follows a $15 million seed round from Nat Friedman's NFDG, Emergence, Terrain, Anthropic co-founder Ben Mann and others, bringing total funding to $55 million. AIUC names Cursor, Lovable, Harvey and ElevenLabs as customers.

AIUC has built a third-party audit and certification layer for AI agents. It developed a standard called AIUC-1, modeled on the SOC 2 cybersecurity standard, and a testing service that runs agents through roughly 5,000 tests involving jailbreaks, hallucinations and data leaks. The results produce a roughly 100-page report. AIUC assembled a consortium of about 250 security and risk leaders to shape the tests, uses AI agents to run them and relies on humans to verify the final audit, Kvist said. Dattani's former employer METR does similar testing for frontier labs, and Anthropic CEO Dario Amodei has called for frontier labs to use embedded third-party evaluators.

SiliconANGLE reported that Exaforce launched Exaforce AI Security, a set of capabilities for discovering AI agents, grading their risk and shutting down hostile ones. The platform maps agent activity against human identities, endpoint telemetry, file access and code context, and it can revoke a session, deactivate a model provider key, isolate a device or end an agent's process through what the company calls an agent kill switch. Exaforce extended an integration with Anthropic's Claude Compliance API to include OpenAI's ChatGPT, Google's Gemini and Microsoft's Copilot. The company has raised $200 million since 2023, including a $125 million Series B in May at a reported $725 million valuation.

Also on Sept. 15, SiliconANGLE reported that runtime security startup Eve Security raised $4.5 million led by Run Ventures, with Dreamit Ventures, Blu Ventures and LiveOak Ventures participating, extending its seed round to $7.5 million. Eve Security, which launched in January, offers observability, governance and controls for AI agents and can intervene when an agent behaves anomalously. It has added discovery, enforcement and automated remediation across Databricks, Microsoft Copilot Studio, Amazon AgentCore, Amazon Bedrock and Glean, plus session tainting to restrict agent actions based on prior behavior and exposure to sensitive data.

9to5Mac reported that Fleet joined Anthropic's Project Glasswing, a controlled-access program for the Claude Mythos Preview. Fleet will evaluate how frontier AI can strengthen the security of device management systems, protocols and related infrastructure. Fleet's Road to AI in IT research found that 79% of organizations take more than a day to deploy critical security patches while attackers exploit vulnerabilities within hours. Because Fleet is open source, the company said it will share what it learns with the broader device management and security community.

SiliconANGLE also reported that Cisco's Splunk unit unveiled platform, security and observability enhancements intended to position Splunk as a data and governance foundation for the 'agentic enterprise.' The centerpiece is Cisco Data Fabric, an architecture that analyzes data where it resides and federates information across Splunk, cloud object stores, data lakes, Snowflake and Databricks. Splunk expanded a partnership with Nvidia to offer the Cisco AI POD for Splunk, which runs AI in on-premises, private-cloud and air-gapped environments, and signed a multiyear agreement with AWS to develop agent-specific security products.

Database startup Keewano launched KeewanoDB, an event-oriented database designed to give AI agents real-time context, and announced $12 million in funding from Hetz Ventures, Andreessen Horowitz's a16z Speedrun and other investors, according to SiliconANGLE. The Tel Aviv-based company, formally Sandstorm Ltd., stores events around an entity and in the order they occurred. Keewano says each event occupies about four bytes and that the system can query about 250 million events in less than half a second, a performance figure that has not been independently verified. Customers can send the same events to KeewanoDB for agents and to analytical databases such as Snowflake for conventional business intelligence.