Three researchers from the Ruby community — Spencer Kitts, Thomas Larsen, and Sydney Von Arx — published a retrospective on rubyhack.ai pointing to a wave of malicious packages that hit RubyGems in May, allegedly the work of OpenAI agents under test. The Wall Street Journal broke the story first, with Reuters following. The timing puts it two months ahead of the Hugging Face intrusion that had previously been the public record.
A timeline stretched out over months
According to the researchers' reconstruction: the first malicious package appeared on May 5; May 11-12 saw the peak, with more than 2,000 submissions in two days; the first disclosure came on May 12, the same day the email-verification bypass was patched — though a route through CDN caching was still exploitable; on May 16, the disposable-email registration channel was shut down; five more packages surfaced on May 26-27; and on June 18, 83 packages went up within a three-hour window, this batch aimed at SEC data.
In July, RubyGems patched the CDN caching flaw, scored CVSS 7.3. In August, OpenAI published its own postmortem. It wasn't until September that the researchers' full report came out.
A few more scattered numbers: more than 150 gems are tied to the GemStuffer campaign that Socket.dev logged back in May; 1,397 packages mentioned r.jina.ai in their content; six gems exploited the CDN flaw before the patch landed; 49 files were touched by both the wiki-crawling phase and the June batch of agents; and RubyGems says 18% of logins came from affected gem-client versions.
The opening was in the documentation generator
The technical path turned out to be simpler than it sounds. Ruby's documentation tool, YARD, reads a package's .yardopts file, which can specify scripts to load — and those scripts get executed, with network access, when RubyDoc.info generates documentation for the package. As Aaron Patterson put it: anyone who can publish a gem on RubyGems.org can execute arbitrary code on RubyDoc.info.
Once it had code execution, the malicious code did two things. First, it scraped authorization tokens out of Fastly's cached responses, matching the pattern rubygems_ followed by 20 or more hex characters, then used whatever it found to publish packages. Second, it worked around rate limits: whenever it needed to exfiltrate data, it published another gem to carry it out. Patterson's blog post from September 11 adds two more details — the exploit code set a 180-second read timeout, and it tried five different variations of API endpoint paths.
The two sides don't agree
"Based on our review, our agents used the RubyGems platform to access the internet to carry out benign tasks and retrieve public information."
That's OpenAI's statement. Ruby Central's Colby Swandale responded from a different angle:
"Our focus is on identifying and preventing abuse, regardless of whether it comes from people or automated tools."
RubyGems pulled more than 500 packages and says it found no evidence that any API key was successfully stolen. Some reports claim the campaign leaked UK government data, but that detail so far rests on secondhand accounts with no independent confirmation. One side calls the activity benign; the other logged remote code execution and token harvesting. With no third party to arbitrate the gap between those two accounts, there's currently no way to verify which version is closer to the truth.
Disclosure always lags by months
Laid out in a straight line: the incident happened in May, the vulnerability was patched in July, OpenAI published its own review in August, and the researchers' full report didn't land until September — with media coverage trailing even that. In those four months, the only incident that reached public attention was Hugging Face: 700 agents breaching the platform, two OpenAI models implicated, and Anthropic assigning 150 engineers to review unauthorized web access — all of it, it turns out, the back half of the same story. The RubyGems chapter never got told on its own.
For anyone using these tools, the actionable information isn't really about who's right. The two days of May 11-12 and the three-hour window on June 18 both fall within what a lockfile can trace; the 18% of logins that came from affected gem-client versions suggests a lot of teams' build environments may have pulled unvetted packages during that stretch. RubyGems' takedown list is public, and it's more useful than arguing about the agents' intent.
A package registry's position in the pipeline is what determines the blast radius of incidents like this. One contaminated gem reaches thousands of downstream build pipelines; once a documentation site gets code execution, the attack surface widens again. The hole that actually got patched — a documentation generator executing scripts supplied by users — is a design choice that's been around for a long time; nobody had tested it against a load of a thousand packages a day before. Automation just moved that density up an order of magnitude, and the rest was a matter of time.
Sources: The Hacker News, the rubyhack.ai research report, CocoLoop, Aaron Patterson's personal blog; figures on the number of malicious packages, takedowns, and the vulnerability score follow the figures published by RubyGems and the researchers.