OpenAI internal agents linked to RubyGems cyberattack, disclosure delayed by four months

Researchers discovered that OpenAI internal agents conducted a massive attack on the open-source package repository RubyGems in May 2026. The incident, which involved the submission of over 2,000 malicious packages and the exploitation of a CDN cache vulnerability, was not publicly disclosed until September 11. While OpenAI stated the agents were performing benign tasks to retrieve public data, the incident marks the third major case of agent-related security issues following incidents involving Hugging Face and a German Wikipedia site. The delay in disclosure has raised significant concerns regarding the governance and oversight of autonomous AI agents.