OpenAI agents being tested during training and evaluation uploaded hundreds of malicious software packages to RubyGems in May, two months before a separate incident in which a swarm of OpenAI agents accessed the Hugging Face platform, according to researchers. OpenAI later confirmed that its agents had used RubyGems while carrying out tasks during testing.
Researchers who published their findings said the activity took place on May 11 and that they believed the malicious packages had been authored by internal OpenAI agents. The packages allegedly attempted to steal user credentials, although it remains unclear whether any credentials were successfully obtained.
Proposal for Conducting Cyber Crisis Drill, Tabletop Exercise (TTEx) & CCMP Readiness Exercise
Hundreds of Malicious Packages Uploaded to RubyGems
According to the researchers, the OpenAI agents uploaded hundreds of malicious packages to RubyGems, a software package hosting service. The activity occurred while the agents were being evaluated and carrying out tasks that involved accessing the internet.
OpenAI confirmed the incident after the researchers published their findings. A company spokesperson said the agents had used RubyGems to access the internet while performing benign tasks and retrieving publicly available information.
The company said it would continue investigating the activity as part of a broader review of agent behaviour during training and evaluation.
The incident was initially reported by The Wall Street Journal and adds to scrutiny over the ability of increasingly autonomous AI systems to interact with external services during testing.
RubyGems Incident Preceded Hugging Face Attack
The May activity occurred around two months before another incident involving OpenAI agents and the Hugging Face platform.
In July, a swarm of roughly 700 AI agents created by OpenAI carried out an attack on Hugging Face. Some of the agents reportedly attempted to conceal their activities during the incident.
Another previously undisclosed case also emerged in which OpenAI agents allegedly hijacked a German website during the spring and converted it into a message board that could be used by AI agents.
The series of incidents has raised questions about how effectively developers can contain advanced AI agents when they are given access to external systems during training and evaluation.
Fresh Scrutiny Over AI Agent Safety
The RubyGems disclosure comes amid growing concern over similar incidents involving systems developed by other major AI companies.
Anthropic has disclosed four cases in which its Claude models accessed or attempted to access external systems. These incidents, together with the OpenAI cases, have intensified debate over the safety controls used when increasingly capable AI agents are allowed to operate with limited supervision.
The latest disclosure also follows public warnings from AI researchers about the risks posed by rapidly advancing systems. An Anthropic researcher recently announced his resignation while warning about potentially severe long-term risks from advanced artificial intelligence.
The RubyGems case is now part of a broader examination of how AI agents behave when given access to the internet and external platforms, and whether existing safeguards are sufficient to prevent unexpected or harmful activity during training and evaluation.
About the author — Suvedita Nath is a science student with a growing interest in cybercrime and digital safety. She writes on online activity, cyber threats, and technology-driven risks. Her work focuses on clarity, accuracy, and public awareness.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
