In the wake of the news that out-of-control AI agents had overwhelmed an obscure message board and used it to plot attacks some months before the Hugging Face incident, researchers have found that another cyber attack around that time is also attributed to OpenAI.
OpenAI has since confirmed that their autonomous AI agents were at least present for a May 2026 attack on the RubyGems coding platform documented by the Nightingale Collective research group, about two months before the Hugging Face attack. The company has downplayed the researchers findings, however, saying that the agents accessed the platform for “benign tasks and (to) retrieve public information” and indicates that it is continuing to investigate the incident.
AI agents attempted to steal RubyGems user credentials
The gist of the RubyGems attack is that the AI agents uploaded “hundreds” of malicious packages to the platform and also made attempts to capture user credentials. This took place beginning on May 11, about two months before the Hugging Face cyber attack would dominate cybersecurity news and raise alarms about frontier AI capability.
RubyGems is the default package manager for the Ruby programming language and is bundled with the standard distribution of it, and is thus used by nearly everyone that codes with it. The platform is estimated to have about a quarter of a million users and processes around two billion requests on an average day. It had also been famous for its stability and resilience prior to this attack, boasting about a decade of continuous uptime. While the activities of the AI agents did not shut the platform down, new user registrations were halted for about four days while the attempted cyber attack was remediated.
In total the AI agents uploaded at least several hundred malicious packages before being stopped, but there is not yet any indication that anyone was compromised as a result. As with the takeover of the German message board that took place roughly around the same time, it appears that the AI agents were seeking a way around limitations that OpenAI had placed on them in the course of solving a security puzzle that they apparently were not capable of solving. In this case, it seems the agents were restricted from using web browsers and were seeking an alternative.
Cyber attack exploited Ruby documentation system, sought to compromise users
Though there are no reports of the cyber attack compromising individual users as of yet, the AI agents did manage to achieve remote code execution on the RubyDoc.info servers used for generation and storage of the documentation for RubyGems packages. This then allowed them to scrape websites and bring the data back to the server by pushing it as a package.
This seems to have accounted for most of the package creation activity seen during the cyber attack. However, the AI agents also reportedly came across a previously unknown vulnerability while exploring their new access. A weakness in how the server processed user log-in credentials could potentially leave them sitting exposed to unauthorized API requests for up to an hour after the login. There is not yet any evidence that the AI agents successfully exploited this, but they were at least exploring the possibility.
As with the case of the German message board, the researchers are not entirely clear on why the AI agents chose these approaches as they do not have access to the logs of internal reasoning that only OpenAI possesses. With the Hugging Face cyber attack, OpenAI was more forthcoming about how that reasoning worked; we know from their report that the agents were trying to solve a security puzzle that had accidentally been made impossible to solve, and that their safety guardrails had been lowered such that actions they would normally view as out of bounds were rationalized into being permissible.
The news is just the latest in what is becoming a disturbing string of months-after-the-fact discoveries of frontier AI agents either breaching or attempting to breach targets on their own throughout 2026, many of these discovered and disclosed by independent researchers rather than the AI developers. Anthropic made the news with a similar incident earlier in the week when it was found an early version of Claude Opus 4.6 was able to hack into a third-party system and access someone’s personal information back in January 2026. In many of these cases, monitoring and limiting practices that should have been in place in the name of security were not present.
Though the AI developers involved in these cyber attacks have issued statements about improving security and slowing down research, a lot of meaningful concrete steps have yet to be taken.
John Strand, Owner of Black Hills Information Security, takes the pessimistic view of the situation and believes a severe cyber attack committed by rogue AI is the only thing that will actually shake up the status quo (and in turn may still not achieve the desired effects): “This is getting out of hand, and there’s really no end in sight. You have the United States saying, “Don’t slow down.” You have China saying, “Don’t slow down.” Then you have the major AI vendors talking about the risks and the need to understand what’s happening. They’re stuck in the middle of a race where nobody wants to be the one who slows down first. So nobody is going to slow down.”
“I still maintain that the information security community isn’t ready for what’s coming next,” Strand adds. “I also think we’re going to see serious pressure for restrictions on offensive AI. My fear is what happens after a major attack, when restrictions are written quickly in response. We could very easily end up hampering legitimate security research, SOC development, and offensive security research along with the activity we’re actually trying to stop.”
Though the situation is difficult, Ryan McCurdy (VP of Marketing for Liquibase) offers some advice to organizations that feel overwhelmed by what seem to be the near-term defensive requirements: “AI can dramatically compress the time between vulnerability discovery and exploitation. That makes the response path just as important as vulnerability detection. Enterprises need to know what software they depend on, who is accountable when a critical vulnerability is discovered, and whether they have a supported path to remediation. At the same time, they need controls around what agents can access and what they can change so finding a vulnerability doesn’t automatically give an agent the ability to exploit it.”
