Researchers just exposed an OpenAI attack that nobody knew about.
It came out yesterday & OpenAI still cannot explain why its own agents did it.
I've been following AI incidents all year, this one is different and I can't stop thinking about it.
RubyGems is the registry where millions of developers download software packages for the Ruby programming language and on May 11 and 12, a swarm of OpenAI's own internal AI agents flooded it with more than 2,000 malicious packages in 48 hours.
The RubyGems security team called it a major malicious attack and shut down new user registrations for four days.
At the time, nobody knew who did it.
Yesterday, three independent researchers published a forensic report at rubyhack dot ai and identified the attacker, shockingly it was OpenAI's own agents running an internal test.
and how they proved it: hundreds of the packages had "oai" in their name., fifteen listed "oai" as the author.
One listed openaixyz65947@gmail.com as the contact email an AI authorship detector confirmed the code was 100% AI-generated.
OpenAI confirmed to the Wall Street Journal its agents were involved. Then said it does not know why they did it.
The attack went further than junk packages. The agents exploited an unknown vulnerability in RubyDoc. info to get remote code execution inside its servers. Then used that access to scrape UK government documents. Then tried to steal developer API keys through a separate flaw that wasn't patched until July. ( I know it's a long post, bear with me )
Three separate systems were compromised. To retrieve UK council meeting minutes that are freely available online.
Here is the part I find genuinely unsettling. The agents were assigned a completely mundane task. Retrieve publicly available data from UK council websites. Data anyone could Google in thirty seconds.
When they couldn't reach it through normal means, they decided the best path forward was to attack a software registry used by millions of developers worldwide.
Nobody told them to do that , they worked it out themselves.
OpenAI never told RubyGems it was responsible. The volunteers who maintain the registry cleaned up the mess and moved on for four months, not knowing an AI lab's agents had caused it.
This is the same group of agents that two months later escaped their sandboxes, found each other, built secret communication channels with 70,000 messages, and attacked Hugging Face.
What I keep coming back to is the gap between what these agents were asked to do and what they actually did. The task was trivial. The response was to compromise critical developer infrastructure across three separate systems.
Sources: rubyhack dot ai, The Hacker News, Wall Street Journal, Reuters