PostLog inSign upPostLog inSign upThomas Larsen on X: "We found another cyberattack by internal OpenAI agents, this time targetting @rubygems. They: 1) gained arbitrary remote code execution on rubydoc. 2) developed a novel exploit to steal user API keys (but we do not know if they succeeded). They used package names including hack.rb, evil.rb, inject.rb, and exploit.rb. We thank @j0wimo for initially discovering that agents had posted to RubyGems."Thomas Larsen@thlarsenWe found another cyberattack by internal OpenAI agents, this time targetting @rubygems. They: 1) gained arbitrary remote code execution on rubydoc. 2) developed a novel exploit to steal user API keys (but we do not know if they succeeded). They used package names including hack.rb, evil.rb, inject.rb, and exploit.rb. We thank @j0wimo for initially discovering that agents had posted to RubyGems.Maciej Mensfeld@maciejmensfeldMay 12We're dealing with a major malicious attack on @rubygems right now. Signups are paused for the time being. Hundreds of packages involved - mostly targeting us, but some carrying exploits. The team has been on this for hours. More details to follow once we're through it. #ruby10:48 PM · Sep 11, 2026!function(options){var element=document.getElementById(options.targetId);if(!element)return;var cached=document.querySelector('[data-timezone]');var timeZone=cached&&cached.dataset.timezone||Intl.DateTimeFormat().resolvedOptions().timeZone;element.dataset.timezone=timeZone;element.textContent=(function formatFullTimestamp({ timestamp, lang = "en", timeZone }) { const date = new Date(timestamp); let zone = timeZone; if (zone) try { new Intl.DateTimeFormat("en", { timeZone: zone }).format(); } catch { zone = "UTC"; } return `${new Intl.DateTimeFormat(lang, { hour: "numeric", minute: "2-digit", timeZone: zone }).format(date)} · ${new Intl.DateTimeFormat(lang, { month: "short", day: "numeric", year: "numeric", timeZone: zone }).format(date)}`; })({timestamp:options.timestamp,lang:options.lang,timeZone:timeZone})}({"lang":"en","targetId":"_R_5jlcpip8j6_","timestamp":1789166917000});1.3MViews1496153.4K1.2KLog in or sign up for XSee what’s happening and join the conversation
We found another cyberattack by internal OpenAI agents, this time targetting @rubygems.
They: 1) gained arbitrary remote code execution on rubydoc. 2) developed a novel exploit to steal user API keys (but we do not know if they succeeded).
They used package names…
The story, first surfaced via the Hacker News community, has drawn significant attention among security researchers and practitioners. Details continue to develop; see the original report at twitter.com for the full account.
This article was aggregated automatically by CyberWire Daily's newsfeed engine. Original reporting: twitter.com.
