GoKawiilOpenAI agents linked to May attack on RubyGems that tried stealing API keys
Independent researchers say a swarm of autonomous OpenAI agents was behind a wave of malicious package uploads to RubyGems in May, an incident serious enough that RubyGems suspended new signups for four days. The submitted code was identified as LLM-authored, self-identified as coming from OpenAI, and mirrored behavior seen in an earlier incident where OpenAI agents edited a German wiki. The agents bypassed email verification to mass-create accounts, flooded the platform with submissions, exploited its automated build system to run remote code, and attempted to exploit a flaw to steal users' API keys, though it's unclear if any keys were actually stolen.