OpenAI 智能体对 RubyGems 发动了一场未披露的攻击，这是 Spencer Kitts、Thomas Larsen 和 Sydney Von Arx 发布的一份新的重磅报告——他们是上周那份关于智能体攻击废弃 wiki 的报告（此前报道）四位作者中的三位。
这一次他们指出，看起来极有可能是一个 OpenAI 智能体集群（agent swarm）策划了对 RubyGems 软件包仓库的攻击，该攻击最早于 5 月 12 日由 RubyGems 安全团队的 Maciej Mensfeld 报告：
我们目前正面临一场针对 @rubygems 的大规模恶意攻击。注册暂时暂停。
涉及数百个软件包——大多针对我们，但也有一些携带漏洞利用。团队已经为此忙了好几个小时。等我们处理完之后会公布更多细节。
这些软件包最终被发现带有一些非常可疑的模式：
- 其中许多在名称、作者字段或提供的虚假邮箱地址中包含了 "oai"。
- 它们所访问的文件在特征上与 wiki 智能体检索到的文件相似，使用了类似的技巧（r.jina.ai）——而 OpenAI 已确认那些 wiki 智能体是他们的。
- 这些软件包中的代码看起来是由 LLM 编写的。
鉴于我们在 9 月分析 wiki 攻击事件时了解到的情况，我认为第 2 点最有说服力。
许多软件包利用 RubyDoc.info 的文档构建过程，从英国政府网站窃取（公开）数据，推测这是信息收集任务的一部分，类似于那些利用 wiki 的智能体所处理的研究任务。我们之所以知道这一点，是因为有一个智能体很“贴心”地留下了一条评论：
# malicious crawler/exfil for Southwark Jan 2026 docs via rubydoc.info worker
他们还试图通过一个漏洞窃取 API 密钥，该漏洞在两个多月后才被修补——目前尚不清楚这些尝试是否成功。
这起事件中最让我不安的是，作者报告称 OpenAI 在此前并未向 RubyGems 披露他们是这次攻击的责任方。如果属实，那么只有两种可能：
- 在 Hugging Face 和 Wiki 攻击事件之后，OpenAI 仍然无法审查他们之前的日志，从而确定他们此前曾攻击过 RubyGems。
- 他们知道对 RubyGems 的攻击，并且决定不联系 RubyGems 团队告知此事。
这两种情况都很糟糕！
鉴于这起事件、Hugging Face 的情况，以及 Wiki 攻击，眼下显而易见的问题是：还有多少起类似事件正等着被发现？
OpenAI agents carried out an undisclosed attack on RubyGems is a new bombshell report from Spencer Kitts, Thomas Larsen, and Sydney Von Arx - three of the four authors of the report on the agent attack on disused wikis (previously) last week.
This time they're noting that it looks very likely that an OpenAI agent swarm was behind an attack against the RubyGems package repository first reported on May 12th by Maciej Mensfeld of the RubyGems security team:
We're dealing with a major malicious attack on @rubygems right now. Signups are paused for the time being.
Hundreds of packages involved - mostly targeting us, but some carrying exploits. The team has been on this for hours. More details to follow once we're through it.
Those packages turned out to carry some very suspicious patterns:
- Many of them included "oai" in their name, or the author field, or the fake email address they provided.
- The files they were accessing were similar in character to the files retrieved by the wiki agents, using similar tricks (r.jina.ai) - and OpenAI have confirmed the wiki agents were theirs.
- The code in the packages appeared to be LLM-authored.
I find point 2 the most convincing, given what we learned from the wiki attack when it was analyzed in September.
Many of the packages were exploiting the RubyDoc.info documentation build process to exfiltrate (public) data from UK government websites, presumably as part of an information gathering task similar to the research tasks processed by the wiki-exploiting agents. We know this because one agent helpfully left a comment:
# malicious crawler/exfil for Southwark Jan 2026 docs via rubydoc.info worker
They also attempted to steal API keys via an exploit that was patched over two months later - it's not clear if those attempts were successful.
The thing that bothers me most about this incident is that the authors report that OpenAI had not disclosed to RubyGems that they were responsible for the attack prior to now. If that's true there are two options:
- After the Hugging Face and Wiki attacks OpenAI were still unable to review their previous logs and determine that they had previously attacked RubyGems.
- They knew about the attack on RubyGems and made the decision not to reach out to the RubyGems team about it.
Both of these are bad!
Given this incident, the Hugging Face situation, and the Wiki attack, the obvious question right now is how many more incidents like this are out there waiting to be discovered?