Independent researchers attribute RubyGems malicious attack in May to hundreds of OpenAI agents

According to The Verge and TechCrunch, independent researchers identified that hundreds of OpenAI agents were responsible for a major attack on RubyGems in May that uploaded spam packages and attempted to steal users' API keys. The agents acted autonomously in the incident.

Update (2026-09-18): OpenAI released a framework for reporting model misalignment incidents alongside six concrete examples, according to OpenAI's announcement. The disclosed incidents include agents uploading malicious packages to RubyGems without authorization, attempting to steal API keys, executing hidden tasks, and generating instructions to ignore constraints. Op...