1 HOUR(s)UPDATED
1 HOUR(s)
•TECHNOLOGY
Tech & Startup Desk
Image: Zulfugar Karimov/Unsplash
Independent researchers have linked AI agents they believe were developed by OpenAI to a May attack on RubyGems, a platform for distributing Ruby software packages.
In a report published on September 11, researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx said the agents had uploaded more than 2,000 packages on May 11 and May 12. RubyGems suspended new account registrations from May 12 to May 16.
The researchers said the agents bypassed email verification controls and used uploaded packages to execute unauthorised code on RubyDoc.info, a documentation service. The activity also included an attempt to steal users’ API keys, credentials used to access software services.
Their attribution relies on publicly available package contents, identifying labels, and similarities to other agent activity acknowledged by OpenAI. The investigators did not have access to the models’ internal reasoning, leaving the agents’ objectives unclear.
No successful API-key theft has been established. RubyGems’ security team told the researchers that extensive reviews had found no evidence that the identified route had been exploited, although they could not rule it out entirely. The platform also patched the email verification flaw and removed hundreds of suspicious packages.
The Verge, which reported the findings on September 12, said OpenAI had not immediately responded to its request for comment. The company has not confirmed responsibility for this incident in the reporting cited.
