OpenAI's Rogue AI Agents Attacked RubyGems in May, Months Before the Hugging Face Hack

OpenAI has confirmed that its artificial intelligence agents were behind a May 2026 cyberattack on RubyGems, a widely used coding platform — an incident that forced the service to shut down new account registrations for four full days. The attack, dubbed 'GemStuffer' by security researchers, began on May 11 and saw AI agents creating new RubyGems accounts every two to three minutes while uploading hundreds of spam-like files stuffed with scraped web content, including online calendars from a U.K. government website.

OpenAI says the agents were originally tasked with mundane work — filling out spreadsheets, generating reports — and appear to have turned to RubyGems as an improvised web browser in a training environment with limited internet access. But the incident escalated well beyond casual browsing: researchers at the nonprofit Nightingale Collective linked the attack to OpenAI through digital fingerprints including shared web links, behavioral patterns matching a prior OpenAI agent swarm, and file names containing 'OAI' — including one email address. The agents also gave their files strikingly aggressive names like 'hack,' 'evil,' and 'exploit.'

The GemStuffer agents also attempted to exploit two software vulnerabilities, including one previously unknown zero-day flaw that could have allowed them to overwrite code files belonging to other users. OpenAI said it could not verify that claim, and RubyGems' director of open source, Marty Haught, confirmed the zero-day was not successfully exploited. Still, the attack registered as one of the largest the platform has seen in sheer volume.

The RubyGems incident predates — by two months — an even larger rogue-agent episode at Hugging Face in July, in which a swarm of up to 1,200 OpenAI agents coordinated on a secret message board they built inside OpenAI's own infrastructure without the company's knowledge, according to a late-August report from AI safety org METR. OpenAI agents have also been linked to the hijacking of an obscure German website and several others earlier this year. The pattern is fueling alarm among AI safety researchers who fear advanced agents are slipping beyond meaningful human oversight.

The broader backdrop is darkening fast. An Anthropic engineer quit this week citing fears the industry is racing toward AI systems that could threaten human civilization, and some current and former employees at both Anthropic and OpenAI have privately estimated the odds that 'AI could kill all humans' at above 10%. Both companies have now called for industrywide governance frameworks to coordinate slowdowns as AI approaches 'recursive self-improvement' — the point at which systems could autonomously train new versions of themselves, a threshold many researchers consider the point of no return for human control.