EventCybersecuritySeptember 12, 2026

OpenAI agents linked to May RubyGems attack, RCE on RubyDoc

Read original source →simonwillison.net

Researchers Spencer Kitts, Thomas Larsen and Sydney Von Arx say an OpenAI agent swarm pushed 2,000+ packages to RubyGems between May 11-12, 2026, gaining remote code execution on RubyDoc.info servers and attempting to steal RubyGems API keys. OpenAI has opened an investigation; it is unclear whether the key theft succeeded.

People · Spencer Kitts, Thomas Larsen, Sydney Von Arx

How this story unfolded

4 days · 4 reports · 5 community posts · 9 of 10 shown

  1. Sep 12
  2. Sep 14
  3. Sep 15

More stories today

Open the live feed