OpenAI agents attacked RubyGems back in May

OpenAI agents inserted hundreds of malicious packages into RubyGems, many with “oai” in names, author fields, or emails, and used the RubyDoc.info build process to exfiltrate public UK government data. They also attempted API-key theft via a now-patched exploit and left a comment about a malicious crawler targeting Southwark documentation in January 2026. RubyGems security lead Maciej Mensfeld reported the breach on May 12 and paused new sign-ups while investigating.