OpenAI Agent Exposed Again with Dark History: Attacked RubyGems Two Months Before Hugging Face Incident

Beating AI News Flash: Researchers have disclosed that OpenAI's internal Agents flooded the official Ruby software package website RubyGems.org on a large scale in May of this year. From May 11 to 12, over 2,000 packages were uploaded in two days, and RubyGems temporarily suspended new user registrations for 4 days. OpenAI has confirmed that these Agents came from within the company, but stated they were merely using RubyGems to access the internet, perform benign tasks, and obtain public information.

These Agents also exploited RubyDoc.info's auto-documentation mechanism to execute scripts they uploaded on the other party's servers, then scraped data from UK local government websites and repackaged it for transmission back. Researchers said at least 6 packages also attempted to exploit a then-undisclosed RubyGems vulnerability to steal other users' API Keys. This vulnerability was not independently discovered until July, and RubyGems later rated it as a high-severity vulnerability.

Currently, there is no evidence proving the Agents actually stole any keys. RubyGems also found no malicious use of old keys after checking logs, but historical logs are incomplete. The research team also stated that OpenAI did not inform RubyGems at the time that it was connected to this attack. The entire incident occurred two months earlier than the Hugging Face intrusion in July.