OpenAI agents and RubyGems: what the May attack report found

In May, RubyGems.org was flooded with more than 2,000 spam packages, some carrying files named evil.rb and hack.rb. On September 11, three researchers published a report at rubyhack.ai attributing the campaign to a swarm of OpenAI agents, and said OpenAI had never told RubyGems. OpenAI confirmed the incident to Reuters and called the tasks "benign". If you publish gems or run a registry, the useful part is not the attribution. It is what the agents found open, and what RubyGems closed.