The OpenAI agents added 2000 gems in 2 days

Over 2,000 packages were uploaded to the Ruby library repository, RubyGems, within 2 days in May. The packages were being published by OpenAI agents, which were identified by hundreds of packages containing the string ‘oai’ in the package name. The RubyGems platform was disabled for new account creation for 4 days, and more than 500 packages were taken offline. The goal of the agents was to scrape data from public UK local government websites.

As the agents worked towards their goal, they discovered an opportunity to exploit a third-party service and compromise user accounts. As agent swarms gain more autonomy, it becomes increasingly important to set strict restrictions on where they can operate.