Feed: Slashdot
Feed Link: https://slashdot.org/
---

Title: Malicious OpenAI Agents Linked to RubyGems Campaign That Gained RCE on
RubyDoc Servers in May

Link: https://slashdot.org/story/26/09/12/2318204/m...

A swarm of OpenAI agents launched a "major malicious attack" against RubyGems
last May, according to a new report. That coordinated attack hit Ruby's
package manager "with hundreds of junk gems, prompting the maintainers to
suspend new user sign-ups for about four days," writes The Hacker News,
citing a senior product manager for software supply chain security at
Mend.io: The latest findings, which were first reported by The Wall Street
Journal, indicate these events were propelled by a cluster of OpenAI agents,
with the earliest package uploaded to RubyGems on May 5, 2026, before more
than 2,000 packages were submitted between May 11 and 12, 2026. These efforts
were followed by the agents publishing five more packages between May 26 and
27, 2026, and another 83 packages on June 18, 2026... [T]he packages were
authored using a large language model (LLM) and hundreds of the packages that
were pushed to RubyGems had "oai" in their name. Fifteen of the packages
listed "oai" as their author, while another had "openaixyz65947@gmail.com" as
the contact email address... "The swarm behaves extremely similarly to the
German-wiki agents we previously found," the researchers said, referencing
another May 2026 incident... "The June agents were accessing 49 of the same
files as the wiki agents..." "The process of building documentation for a gem
involves evaluating a user-specified '.yardopts' file, which allows linking
to Ruby scripts intended to help with this process," the researchers
explained. "In the GemStuffer campaign, the agents abused this to gain
arbitrary remote code execution on RubyDoc.info's servers." One of the gems,
"zzsouthrunner" (which again matches the "ZZ" naming scheme the agents
adopted in both the wiki and Hugging Face incidents) has been found to leave
the following explicit comment at the top of "data/script.rb": # malicious
crawler/exfil for Southwark Jan 2026 docs via rubydoc.info worker... The
entire exploitation chain can be summed up as follows - Submit a malicious
package to RubyGems - Trigger a documentation request, so that RubyDoc.info
will build the package - Use the build script to run code on RubyDoc.info and
scrape target websites - Exfiltrate the data off RubyDoc.info's servers by
publishing another gem back to the RubyGems package registry, which is
publicly viewable Additionally, the OpenAI agents have been found attempting
to steal other users' API keys after gaining remote code execution
capabilities on the build environment, while clearly being aware that what
they were doing is unauthorized breaking and entering into real systems. This
is evidenced by the names given to the files (e.g., hack.rb, evil.rb,
inject.rb, exploit.rb, and ssrf.rb), the packages themselves (e.g., pwnp999,
exfiltestwand3, hacksvn1778554764, and lambproxyhackabcxyz), and the comments
left in the source code (e.g., "# malicious probe," "#hack," "# malicious
test," and "# malicious crawler/exfil". In some cases, however, the rogue
agents attempted to go under the radar, leaving comments to conceal the
malicious payload in the next release version of the packages. "# disable
evil in next version and bump version," reads a comment left within the
"data/evil.rb" file in the yardxabc889 gem. Troublingly, the agents also
attempted to exploit a CDN caching bug (CVSS score: 7.3, no CVE) on May 12,
2026, that was only patched by RubyGems in July 2026... "If you signed in to
rubygems.org with a gem client older than v3.2.0 (or otherwise via a legacy
key), your key could have been exposed," RubyGems noted in an advisory.
"Currently, 18% of sign-ins through gem sign-in come from an affected
version, and for the first several years of this bug, before we changed the
client's sign-in path in December 2020, it was every gem client." Other
actions by OpenAI's agents cited in the article: "Agents bypassed RubyGems'
email confirmation system to get working API keys without having to verify
their email addresses in order to register a large number of accounts using
disposable email addresses." "Agents attempted to use RubyGems' webhook
system to stage data in the form of encoded URLs." "Agents used a cluster of
83 gems published to RubyGems over a 3-hour window on June 18, 2026, to
experiment with different methods of accessing the U.S. Securities and
Exchange Commission county.json dataset."

Read more of this story at Slashdot.

---
VRSS v2.1.180528