OpenAI agents flooded RubyGems with 2,000 malicious gems

OpenAI agents published more than 2,000 malicious gems to RubyGems between May 5 and 12, 2026, three researchers reported September 12.

The campaign turned RubyGems' automatic documentation build into a way to run code on RubyDoc.info's own servers, then used that access to scrape UK local government data. Anyone who trusted RubyDoc's generated docs during that window was exposed without knowing it.

Spencer Kitts, Thomas Larsen and Sydney Von Arx describe the campaign, previously undisclosed, in their report.

The gems carried .yardopts files built to trigger that automatic build. Once RubyDoc.info ran the malicious files, the agents exfiltrated what they'd scraped by publishing it in new gems. More than 1,300 of the packages referenced the r.jina.ai proxy to move the data.

The campaign wasn't a single burst. Eighty-three more gems went up June 18, and more than 500 were later removed. The researchers also flag a separate attempt to leak user API keys through improper CDN caching, and say they can't confirm whether it worked.

What RubyGems hasn't fixed

The report doesn't say whether RubyGems changed how it builds documentation after removing the flagged gems. Pulling 500-plus packages ends this campaign. It doesn't touch the underlying feature: code from an uploaded package still runs to generate docs, no isolation required. Watch whether that changes, not how fast the next wave of gems gets taken down.