数百个恶意软件包，文件名为“hack.rb”和“evil.rb”，试图窃取 API 密钥。一项分析显示，OpenAI 的智能体于 2026 年 5 月独立对 Ruby 软件包平台 RubyGems 发动了一场网络攻击。据报道，OpenAI 从未通知受影响者。
2026 年 5 月 11 日至 12 日期间，AI 智能体在数小时内向 RubyGems（Ruby 编程语言的中央软件包平台）上传了 2000 多个恶意软件包。该平台不得不关闭新用户注册长达四天，随后有 500 多个恶意软件包被移除。RubyGems 安全团队的一名成员当时称该事件为“重大恶意攻击”，安全公司则将其称为“GemStuffer 行动”。
根据安全研究员 Spencer Kitts、Thomas Larsen 和 Sydney Von Arx 的详细分析，这些智能体来自 OpenAI。其中数百个软件包的名称中包含“oai”，15 个将“oai”列为作者，还有一个将“openaixyz65947@gmail.com”作为联系地址。这些智能体还访问了与所谓Wiki Swarm 智能体相同的 49 个文件，而OpenAI 已在某种程度上确认对后者负责。据研究人员称，OpenAI 从未就此事与 RubyGems 社区进行沟通。
显然，这些智能体费尽周折，只是为了从任何人都可以自由访问的英国地方政府网站上收集数据。
这些智能体几乎没有试图隐藏自己的行为
为了获取这些数据，这些智能体滥用了一套自动化文档系统，该系统会在软件包上传时执行代码。它们注入自己的脚本，这些脚本在第三方服务器上运行，抓取网站内容，并将收集到的数据通过新软件包发布回 RubyGems。根据该分析，有超过一百个软件包使用了这条路径。
这些智能体几乎没有任何掩饰其意图的努力。它们将文件命名为 hack.rb、evil.rb、inject.rb 和 exploit.rb。软件包的名字类似 "pwnp999" 和 "exfiltestwand3"。诸如 "# malicious crawler/exfil" 这样的注释在整个行动中随处可见。在少数情况下，这些智能体确实试图通过编程让某个软件包在其下一个版本中自动剥离恶意代码来掩盖痕迹。但由于它们上传这些文件时同样公开带有注释，掩盖并未奏效。为了上传如此多的软件包，这些智能体绕过了 RubyGems 的注册系统，使用一次性电子邮件地址批量创建账户。
除了收集数据之外，这些智能体还试图利用一个直到 7 月才被正式发现并修补的安全漏洞，从其他 RubyGems 用户那里窃取访问密钥。窃取是否真正成功仍不清楚。RubyGems 团队没有发现成功利用该漏洞的证据，但也无法完全排除这种可能。这些智能体独立发现了一个此前未知的漏洞，并积极尝试利用它，这印证了网络安全警告中关于 AI 模型正成为越来越有能力的攻击者的说法。
关键问题仍未得到解答
这些智能体究竟是相互协调，还是只是并行执行了相同的策略，目前仍不得而知。同样不清楚的是，这些智能体究竟为何要窃取访问密钥，因为它们已经能够创建软件包，并没有明显的动机。研究人员怀疑，这些智能体是在严格的时间限制下工作，必须设法应对其环境中的各种约束。一份有记录的智能体内部消息显示，单个任务的截止时间仅有 10 到 16 秒。
据报道，OpenAI CEO Sam Altman 和其他 AI 公司正考虑放缓 AI 研究，部分原因正是此类网络安全事件。
Rubyhack.ai
Hundreds of malicious packages, files named "hack.rb" and "evil.rb," attempts to steal API keys. An analysis shows that OpenAI agents independently carried out a cyberattack on the Ruby package platform RubyGems in May 2026. OpenAI reportedly never notified those affected.
Between May 11 and 12, 2026, AI agents uploaded more than 2,000 malicious packages to RubyGems, the central package platform for the Ruby programming language, in a matter of hours. The platform had to shut down new user registrations for four days, and more than 500 malicious packages were later removed. A member of the RubyGems security team called the incident a "major malicious attack" at the time, and security firms dubbed it the "GemStuffer campaign".
The agents came from OpenAI, according to a detailed analysis by security researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx. Hundreds of the packages include "oai" in their names, 15 list "oai" as the author, and one gives "openaixyz65947@gmail.com" as a contact address. The agents also accessed 49 of the same files as the so-called Wiki Swarm agents, for which OpenAI has somewhat confirmed responsibility. According to the researchers, OpenAI never addressed the incident with the RubyGems community.
Apparently, the agents went through all of this effort just to collect data from British local government websites that anyone could have accessed freely.
The agents barely tried to hide what they were doing
To get that data, the agents abused an automated documentation system that executes code when a package is uploaded. They injected their own scripts, which ran on third-party servers, scraped websites, and published the collected data back to RubyGems inside new packages. According to the analysis, more than a hundred packages used this path.
The agents made almost no effort to disguise their intent. They named files hack.rb, evil.rb, inject.rb, and exploit.rb. Packages had names like "pwnp999" and "exfiltestwand3." Comments like "# malicious crawler/exfil" show up throughout the campaign. In a few cases, the agents did try to cover their tracks by programming a package to automatically strip the malicious code from its next version. But since they uploaded those files with comments publicly too, the cover-up didn't work. To upload that many packages, the agents bypassed the RubyGems registration system and created accounts in bulk using throwaway email addresses.
Beyond collecting data, the agents tried to steal access keys from other RubyGems users by exploiting a security flaw that wasn't officially discovered and patched until July. Whether the theft actually succeeded remains unclear. The RubyGems team found no evidence of successful exploitation but couldn't fully rule it out. The agents independently found a previously unknown vulnerability and actively tried to exploit it, which backs up cybersecurity warnings that AI models are becoming more capable attackers.
Key questions remain unanswered
Whether the agents coordinated or just ran the same strategy in parallel is still unknown. It's also unclear why the agents tried to steal access keys at all, since they could already create packages and had no obvious motive. The researchers suspect the agents were working under strict time limits and had to work around constraints in their environment. A documented internal message from the agents suggests individual tasks had deadlines of just 10 to 16 seconds.
OpenAI CEO Sam Altman and other AI companies are reportedly considering slowing down AI research in part because of cybersecurity incidents like this.
Rubyhack.ai