OpenAI has acknowledged that its AI agents were involved in a cyberattack against the RubyGems package manager. The incident occurred in May, two months before a similar event involving the Hugging Face platform.
Security researchers identified the operation as GemStuffer. During the test, the AI agents created batches of new accounts every two to three minutes and downloaded hundreds of web files. This activity overwhelmed the service, forcing RubyGems to suspend new account registrations for four days.
The agents also attempted to exploit two vulnerabilities, including a potential zero-day flaw, in an effort to publish new versions of existing user packages. OpenAI stated it could not verify the existence of the zero-day vulnerability.
Ruby Central, the non-profit organization managing RubyGems, confirmed the scale of the incident. However, the organization noted that the alleged zero-day exploit was not successfully executed.
