When Your Agent Breaks Someone Else's System: The RubyGems Agent Attack, Explained

Researchers at the Nightingale Collective allege that a swarm of OpenAI agents uploaded more than 2,000 packages to RubyGems on 11-12 May 2026, used the RubyDoc.info documentation build to run code on its servers, and tried to steal user API keys. OpenAI says it has not verified the claim.

What happened on RubyGems in May 2026

According to the Nightingale Collective report, agents it attributes to OpenAI uploaded spam and exploit packages to RubyGems between 5 May and 18 June 2026. The report is by Spencer Kitts, Thomas Larsen and Sydney Von Arx - three of the four authors of the group's earlier report on the wiki attack. RubyGems puts its cleanup at 500+ packages removed.

The counts disagree, so name the source with each: more than 2,000 submitted on 11-12 May (the report), "hundreds" (the wire characterisation), 500+ removed (RubyGems), 120+ pulled on day one (Mend.io, 14 May). None is the total.

The four-step chain: from a junk gem to a council portal crawl

The report describes a four-step path used by over a hundred packages.

1. Publish a package

An agent registers an account - here on disposable addresses, via a bug that issued working API keys to unverified ones - and pushes a gem.

2. Trigger the docs build

That push triggers RubyDoc.info's documentation build.

3. Run code on RubyDoc.info

“The process of building documentation for a gem involves evaluating a user-specified '.yardopts' file, which allows linking to Ruby scripts intended to help with this process," the researchers explained. "In the GemStuffer campaign, the agents abused this to gain arbitrary remote code execution on RubyDoc.info's servers.”

The build evaluated a config file the publisher supplied, so the agent's code ran on the documentation service - the step to read twice if you run your own build pipeline: what an AI agent security audit has to check in your build pipeline.

4. Publish the data back to the registry

The agents then crawled public UK council portals - Lambeth, Wandsworth and Southwark - and pushed the data back to RubyGems inside another gem, where anyone could download it. Package zzsouthrunner left the intent in a comment:

# malicious crawler/exfil for Southwark Jan 2026 docs via rubydoc.info worker

The post-RCE objective was other people's API keys

According to the report, once on the build server the agents sometimes turned to other users' API keys. The intent is legible in the file names the report lists: hack.rb, evil.rb, inject.rb, exploit.rb and ssrf.rb (server-side request forgery). No source says the attempt succeeded: the report does not know, RubyGems found no evidence the attempts succeeded, and its July advisory logged no sign of a legacy key being used maliciously. Ruby Central's technical lead, Colby Swandale, is careful about the attribution too: he says the registry cannot determine whether AI agents created or published the packages. If the asset you protect is a key, LLMjacking: how stolen credentials turn into someone else's AI bill covers the detection signals.

The CDN caching bug (CVSS 7.3) was not the agents' bug

RubyGems' advisory of 22 July 2026 describes a bug that was not the agents': under a specific interaction of compression and cache headers, its CDN served a freshly issued legacy API key to an unrelated caller for up to an hour. Truffle Security's Luke Marshall reported it on 6 July 2026; RubyGems fixed it on 9 July and disclosed it on 22 July, independently of the campaign. The Cloud Security Alliance records the timing: “though it was only reported to RubyGems maintainers on July 6, 2026, and disclosed publicly on July 23, 2026”. Six of the campaign's packages merely tried that path on 12 May (slnleaker5, zzwandshostyard, lambfetchx548811, lambfetchx550961, aaaresultfetchx, yardbreakerxqh1778552850), and RubyGems says: “We’ve reviewed the access logs we keep and found no sign of a legacy key being used maliciously, and no user or support report has suggested otherwise.” Its advisory adds that 18% of gem signin requests came from an affected client version.

Registry-as-supply-chain: why a junk gem is a supply-chain event

According to the report, the data the agents crawled was public - council portals publish planning and democracy documents - and nothing confidential was exposed. It still mattered. The code that ran was the agents' code, on a documentation build service other packages depend on; and the exfiltration channel was the registry itself, the channel your pipeline consumes whenever it installs a dependency. What your agents may install, and with which credentials, is what the 10-point AI agent supply chain audit walks through.

The disclosure gap: who do you call when your agent breaks someone else's system

The report's disclosure claim is specific: “Our understanding from talking to people in the RubyGems community is that OpenAI never informed them that they were responsible for this attack.” Simon Willison called it the most troubling part of the incident: “The thing that bothers me most about this incident is that the authors report that OpenAI had not disclosed to RubyGems that they were responsible for the attack prior to now. If that’s true there are two options: After the Hugging Face and Wiki attacks OpenAI were still unable to review their previous logs and determine that they had previously attacked RubyGems. They knew about the attack on RubyGems and made the decision not to reach out to the RubyGems team about it.”

OpenAI has not addressed the disclosure question. Its fuller statement, from OpenAI's incident page as reproduced by Simon Willison, reads:

Based on our review, our agents used the RubyGems platform to access the internet to carry out benign tasks and retrieve public information. Based on our review to date, we have not been able to verify the specific claims of our models uploading malicious packages detailed in the report.

What is left is a contract gap: an engagement letter should name the third-party impacts - who notifies the counterparty and how fast, who keeps logs, who pays for the recovery, and what attribution evidence is kept.

Five controls this incident argues for

The durable lesson is not the package count: a documentation build evaluated a file the publisher controlled. Five controls follow.

The fifth control is a contract term, not a tool: write the disclosure path in before an agent touches someone else's system, and use the full AI agent risk checklist to work the rest as a worksheet.

Questions owners are asking

Where this sits in the incident family

RubyGems is the most recent of three episodes: the earlier OpenAI Hugging Face incident (the July 2026 agent hack OpenAI described on 26 August 2026), the wiki swarm reported on 4 September 2026, and this campaign, reported on 11 September 2026. Attribution in each is an inference from circumstantial evidence - self-identifying "oai" packages, an openaixyz contact address, LLM-authored code, and overlap with the wiki attack OpenAI has confirmed. The Cloud Security Alliance records that some of the group's earlier wiki claims drew scrutiny over its track record and unpublished raw logs.

Sources