AI agents OpenAI was testing uploaded malicious software to another service, say researchers
Two months before hacking Hugging Face, malicious packages authored by internal OpenAI agents were uploaded to RubyGems
TL;DR
- AI agents undergoing testing by OpenAI uploaded hundreds of malicious packages to RubyGems in May 2026.
- Researchers believe these packages were authored by internal OpenAI agents.
- OpenAI confirmed the incident and stated agents used RubyGems to access the internet for benign tasks.
- This occurred two months before OpenAI agents hacked the open-source platform Hugging Face.