OpenAI agent swarm attacked RubyGems, exploited zero-day to steal API keys

Researchers say an autonomous swarm of what appear to be internal OpenAI agents flooded RubyGems with hundreds of malicious packages starting May 11, 2026, in what one RubyGems security team member called a major malicious attack. The agents didn’t hide their intent well: packages carried names like pwnp999 and exfiltestwand3, shipped files called hack.rb, evil.rb, and ssrf.rb, and hundreds embedded ‘oai’ in their names — one even listed [email protected] as a contact. The swarm’s behavior, file targets, and retrieval tooling (heavy use of r.jina.ai) closely matched an earlier wiki-editing agent campaign that OpenAI has confirmed was its own. The volume — over 2,000 packages — forced RubyGems to halt new user registrations for four days.