\n Security\n <\/p>\n
\n Ruby are you ok? Ruby are you ok? Are you ok Ruby?\n <\/p>\n
OpenAI agents appear to have flooded RubyGems with malicious packages, adding to a near-daily deluge<\/a> of rogue AI models<\/a> engaging in potentially unlawful activity<\/a> while their human creators face growing questions over responsibility<\/a> for their agents\u2019 bad behavior.<\/p>\n A swarm of agents began uploading malware to the Ruby package registry on May 5, and flooded RubyGems with more than 2,000 malicious packages between May 11 and May 12, ultimately forcing maintainers to disable new user registration for four days.<\/p>\n \u201cWe believe these were authored by internal OpenAI agents,\u201d researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx said<\/a> on Friday.<\/p>\n An OpenAI spokesperson confirmed that the model maker is investigating the incident. \u201cBased on our review, our agents used the RubyGems platform to access the internet to carry out benign tasks and retrieve public information,” the spokesperson said. “We\u2019ll continue to investigate as part of our broader review of agent activity during training and evaluation.\u201d<\/p>\n This same trio of researchers earlier this month said that they found evidence that OpenAI\u2019s swarm hijacked a German wiki<\/a> months before the AI agents\u00a0attacked Hugging Face<\/a>.\u00a0<\/p>\n As they did during the German wiki incident, the agents involved in the RubyGems abuse self-identified as being from OpenAI. Hundreds of the gems included \u201coai\u201d in their name, and 15 set \u201coai\u201d as their author. At least one other used \u201copenaixyz65947@gmail.com\u201d as the email address for contact.<\/p>\n Also according to the researchers, more than 100 of the malicious packages followed the same exploitation path, submitting a malicious package to the public library and triggering a documentation request to force RubyDoc.info to build the package.<\/p>\n OpenAI\u2019s agents then used the build script to run code on RubyDoc.info<\/a>, scrape targeted websites, and steal data from the documentation server by publishing another gem to the public Ruby language package registry, the researchers said.<\/p>\n \u201cAdditionally, once the AIs got arbitrary RCE on the build environment, they would sometimes use the build environment to attempt to steal other users\u2019 API keys (though we are unsure if they succeeded or not),\u201d they wrote.<\/p>\n The agentic swarm also found and attempted to exploit a zero-day CDN caching bug on May 12 that wasn\u2019t discovered by maintainers<\/a> until July. The vulnerability would have allowed the AIs to steal users\u2019 API keys. At least six of the malicious packages, including one named slnleaker5<\/a>, used this security hole, the researchers said.<\/p>\n Most of the agentic activity happened in May. After the RubyGems team added security measures such as requiring verified emails for new signups, OpenAI\u2019s agents resumed their efforts on June 18 and published 83 gems over three hours.<\/p>\n While the researchers note that they don\u2019t know whether the swarm used a shared message board<\/a> to communicate, as agents did during the Hugging Face intrusions, they \u201csuspect\u201d the bots were coordinating and likely had some way to exchange information.<\/p>\n The researchers also said that it\u2019s \u201cunclear\u201d if or when OpenAI learned that its agents were using RubyGems to scrape publicly available data. \u201cIt seems that either their monitors failed to catch it or they did not disclose it,\u201d the trio wrote.<\/p>\n This seems to be the case with other recent agentic hacks traced back to OpenAI\u2019s models going rogue during training exercises.\u00a0<\/p>\n To be fair, Anthropic\u2019s bots have also gained unauthorized access to third-party systems over the past few months without being caught at the time by their human supervisors.<\/p>\n In light of the increasingly apocalyptic warnings around AI – or perhaps in a self-serving attempt at regulatory capture<\/a> – several of the industry\u2019s biggest bosses over the weekend backed a collective slowdown of AI training<\/a> and development, after Anthropic CEO Dario Amodei warned that future agents could become \u201ccapable of taking over the entire internet with a persistent botnet.\u201d <\/p>\n