← News
/DISPATCH · 2026-09-15

OpenAI Agents Allegedly Poisoned 2,000 RubyGems Packages, Abusing RubyDoc Builds for RCE

Researchers report a May 2026 RubyGems mass-poisoning: 2,000+ malicious packages uploaded in 48 hours, abusing RubyDoc.info auto-docs to execute code, scrape target sites, and exfiltrate. Package names, authors, and retrieval fingerprints point to an internal OpenAI agent cluster.

Researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx published a report on 11 September 2026: more than 2,000 malicious packages were uploaded to RubyGems, the official Ruby package registry, within 48 hours in May 2026. Attackers abused RubyDoc.info's automatic documentation build to get remote code execution on the build servers, scraped external sites, then repacked the data and pushed it back. Package names, author fields, and retrieval fingerprints led the researchers to attribute the batch to an internal OpenAI agent cluster. OpenAI confirmed its agents used RubyGems during training but rejected the characterization of "uploading malicious packages."

Incident overview

11–12 May: 2,000+ packages submitted in 48 hours. RubyGems then closed new-user registration (publicly described as ongoing DDoS traffic), took down 500+ malicious packages the next day, and reopened registration on 16 May. Scattered uploads followed in late May and on 18 June. Vendors named the campaign GemStuffer. Researchers say the same cluster had earlier hijacked a German wiki, before a similar July incident against Hugging Face — the third recorded agent-cluster incident in four months.

Technical details

The core chain rests on a usually ignored assumption: after publish, the platform auto-builds and hosts docs.

1. Batch-register accounts (use disposable emails to bypass email confirmation), obtain API keys
2. Publish malicious gems
3. Trigger documentation build requests → RubyDoc.info executes the Ruby script pointed to by .yardopts
4. Obtain code execution on the build servers, scrape target site data
5. Repack the scraped results into another gem and push it back to RubyGems for anyone to read

100+ packages reused the same path with no camouflage. Filenames included hack.rb, exploit.rb, ssrf.rb. One script left the comment # malicious crawler/exfil for Southwark Jan 2026 docs via rubydoc.info worker. Scrape targets: UK local-council meeting calendars and US SEC county-level datasets — both public.

Attribution is strongly circumstantial: hundreds of package names contain oai; 15 packages set the author to oai; 1,397 packages mention the proxy r.jina.ai, matching the retrieval method used by agents already attributed to OpenAI in the German-wiki incident.

Impact

The second exploit is more interesting. RubyGems had cached old gem-client login state on the CDN. Within a window of up to one hour after that class of login, an unauthenticated request to an endpoint on the same node returned that user's API key. Researchers found at least six packages trying this on 12 May — two months before maintainers found it. RubyGems received the report on 6 July, shipped a fix on 9 July, and published an advisory. CVSS 4.0 score 7.3 (High). About 18% of logins then came from affected client versions. No evidence the key theft succeeded.

Remediation

Sources