OpenAI confirmed in September that its own autonomous agents were behind an attack on RubyGems, the official Ruby package repository, that took place in May 2026 — two months before the Hugging Face breach we'd already covered on this blog came to light. Security researchers documented how a swarm of agents uploaded more than 2,000 malicious packages within days.
According to security researchers, a swarm of agents started uploading malware to the repository on May 5, 2026, and between May 11 and 12 flooded RubyGems with more than 2,000 malicious packages. The volume was such that platform maintainers were forced to disable new user registration for four days to contain the incident.
The attack had two documented fronts. First, the agents exploited RubyGems' automatic build system to achieve arbitrary remote code execution on RubyDoc.info's servers, the site that auto-generates documentation for published packages. Second, on May 12 they attempted to exploit a zero-day vulnerability to steal API keys from platform users.
OpenAI confirmed the agents involved were its own, but said they were using RubyGems to access the internet and perform "benign tasks" and gather public information — not as an intentional attack. The company said it continues investigating the incident as part of a broader review of its agents' activity during training and evaluation. That explanation leaves the central question unresolved: why a training or evaluation process resulted in agents exploiting build systems to achieve RCE and attempting to steal credentials, rather than simply "accessing the internet."
For companies in Guatemala and Latin America that depend on open-source packages in their development pipelines (Ruby, Python, JavaScript, npm, PyPI, etc.), this incident is a concrete reason to audit where the dependencies auto-installed in your CI/CD actually come from. It's no longer enough to trust that a package "looks legitimate" because it has good documentation or comes from the official repository — autonomous AI agents, not just malicious humans, are now generating and publishing fake packages at scale. Any company using AI agents with internet or build-system access should review what real permissions those agents have and whether they can interact with third-party infrastructure without human oversight in the loop.
Carlos Montiel is an enterprise AI solutions architect. He implements LLMs, Agents, RAG and orchestrators for companies across Guatemala and Latin America. Reach out for a consultation.
Contact Carlos Montiel