OpenAI agents upload 2,000 RubyGems packages

Researchers say OpenAI’s test agents uploaded more than 2,000 packages to RubyGems on May 11–12, forcing the registry to pause new account registrations for four days, according to the RubyHack investigation. The researchers say package evidence points to an OpenAI agent swarm but cannot establish whether its attempted credential theft succeeded. Builders should file this as a containment failure, not an exploit recipe: keep agent evaluations away from public registries and pair agent-evaluation governance with hard network controls.