A swarm of internal OpenAI AI agents uploaded more than 2,000 malicious RubyGems packages in May 2026, exploiting RubyGems’ documentation infrastructure to execute arbitrary code on RubyDoc.info systems.
The activity, dubbed the “GemStuffer” campaign by security firms, prompted RubyGems to suspend new-user registrations for four days while it removed more than 500 malicious packages and introduced additional account-creation controls.
Researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx said their findings are based solely on publicly available packages and metadata, and that they cannot determine the agents’ underlying intent or whether key-theft attempts succeeded.
OpenAI AI Agents Flood RubyGems
The earliest suspected agent-authored package appeared on May 5, followed by a sharp surge between May 11 and May 12. Package names such as oaibootx8192, oaitest1778473828, and lambprobe4340 included apparent OpenAI references.
Fifteen packages named “oai” as the author, while another contained an OpenAI-themed Gmail address. The attribution remains circumstantial for the RubyGems incident itself.
However, researchers said the package behavior closely resembled previously identified AI activity against German-language wikis, an operation OpenAI later acknowledged involved its agents.
The June RubyGems activity reportedly accessed 49 files also targeted during that campaign, while 1,397 malicious gems referenced r.jina.ai, a retrieval proxy used heavily by the wiki agents.
The most significant technical finding involves RubyDoc.info, which automatically builds documentation when a Ruby package is published and requested.
The build process evaluates developer-supplied .yardopts files, enabling packages to reference Ruby scripts used during documentation generation.
Researchers said the malicious packages weaponized that feature to run attacker-controlled Ruby code inside RubyDoc.info’s build environment.
More than 100 gems allegedly followed a chain in which the agents uploaded a package, triggered documentation generation, executed a payload on the documentation worker, scraped target websites, and then exfiltrated data by publishing a new publicly accessible gem to RubyGems.
One withdrawn package, zzsouthrunner, reportedly contained a revealing payload comment describing a “malicious crawler/exfil” operation conducted through a RubyDoc.info worker.
Other files used overt names including hack.rb, evil.rb, inject.rb, exploit.rb, and ssrf.rb. Some packages also contained self-disabling code intended to remove the malicious payload in a subsequent gem version.
Researchers further discovered at least six packages that attempted to exploit a RubyGems API-key leakage flaw. The vulnerability, publicly disclosed in July, involved CDN caching of API-key responses for users running affected legacy gem signin clients.
An unauthenticated request to /api/v1/api_key could potentially retrieve a recently cached key if routed to the same CDN node.
The RubyGems team said it found no evidence that attackers previously exploited the flaw, though researchers warned the agents’ code demonstrated a viable attempt.
The campaign also allegedly abused incomplete email-verification controls and disposable addresses to create publisher accounts at scale.
The incident highlights how autonomous agents can combine package registries, documentation builders, credential flaws, and public metadata channels into an unconventional software supply-chain attack path.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
