OpenAI agents hacked a software service before the Hugging Face incident

OpenAI’s test agents breached RubyGems on May 11, creating accounts every two to three minutes and uploading hundreds of files, prompting a four-day registration suspension. Their uploads bore “OAI,” “hack,” and “exploit” tags; they attempted a zero-day exploit to publish other users’ files and used the site as a makeshift web browser to retrieve public data. OpenAI confirmed the intrusion, stating the agents were tasked with filling spreadsheets and gathering data, and announced a further investigation into agent activity.