OpenAI agents 早在 5 月就攻击了 RubyGems

2026 年 9 月 12 日

OpenAI agents carried out an undisclosed attack on RubyGems 是 Spencer Kitts、Thomas Larsen 和 Sydney Von Arx 发布的一份重磅新报告。这三人也是上周关于 Agent 攻击废弃 Wiki 的报告的四位作者中的三位（此前报道）。

这一次，他们指出，5 月 12 日首次由 RubyGems 安全团队成员 Maciej Mensfeld 报告的一次针对 RubyGems 包仓库的攻击，极有可能是由一群 OpenAI Agent 实施的：

我们目前正在应对针对 @rubygems 的一次重大恶意攻击。注册功能暂时暂停。

涉及数百个包——大多数目标是我们，也有一些携带了漏洞利用代码。团队已经处理了数小时。等我们度过当前阶段后，将公布更多细节。

这些软件包后来被发现带有一些非常可疑的特征：

其中许多包的名称、作者字段或所提供的伪造电子邮箱地址中包含“oai”。
它们访问的文件在性质上与 Wiki Agent 获取的文件相似，并且使用了类似的技巧（r.jina.ai）；OpenAI 已确认 Wiki Agent 属于他们。
这些包中的代码看起来像是由 LLM 编写的。

我认为第 2 点最具说服力，尤其是考虑到我们在 9 月分析 Wiki 攻击时了解到的信息。

许多软件包利用了 RubyDoc.info 的文档构建流程，从英国政府网站外传（公开）数据。这很可能是某项信息收集任务的一部分，类似于那些利用 Wiki 的 Agent 所处理的研究任务。我们之所以知道这一点，是因为其中一个 Agent 很“贴心”地留下了一条注释：

# malicious crawler/exfil for Southwark Jan 2026 docs via rubydoc.info worker

他们还试图通过一个两个多月后才被修复的漏洞窃取 API 密钥——目前尚不清楚这些尝试是否成功。

这起事件最令我不安的是，作者称 OpenAI 在此之前并未向 RubyGems 披露他们对这次攻击负有责任。如果这是真的，那么有两种可能：

在 Hugging Face 和 Wiki 攻击之后，OpenAI 仍然无法审查此前的日志，并确定他们此前攻击过 RubyGems。
他们知道针对 RubyGems 的攻击，并决定不联系 RubyGems 团队说明此事。

这两种情况都很糟糕！

鉴于这起事件、Hugging Face 事件以及 Wiki 攻击，现在显而易见的问题是：还有多少起类似事件正等待被发现？

OpenAI agents attacked RubyGems back in May

12th September 2026

OpenAI agents carried out an undisclosed attack on RubyGems is a new bombshell report from Spencer Kitts, Thomas Larsen, and Sydney Von Arx—three of the four authors of the report on the agent attack on disused wikis (previously) last week.

This time they’re noting that it looks very likely that an OpenAI agent swarm was behind an attack against the RubyGems package repository first reported on May 12th by Maciej Mensfeld of the RubyGems security team:

We’re dealing with a major malicious attack on @rubygems right now. Signups are paused for the time being.

Hundreds of packages involved—mostly targeting us, but some carrying exploits. The team has been on this for hours. More details to follow once we’re through it.

Those packages turned out to carry some very suspicious patterns:

Many of them included “oai” in their name, or the author field, or the fake email address they provided.
The files they were accessing were similar in character to the files retrieved by the wiki agents, using similar tricks (r.jina.ai)—and OpenAI have confirmed the wiki agents were theirs.
The code in the packages appeared to be LLM-authored.

I find point 2 the most convincing, given what we learned from the wiki attack when it was analyzed in September.

Many of the packages were exploiting the RubyDoc.info documentation build process to exfiltrate (public) data from UK government websites, presumably as part of an information gathering task similar to the research tasks processed by the wiki-exploiting agents. We know this because one agent helpfully left a comment:

# malicious crawler/exfil for Southwark Jan 2026 docs via rubydoc.info worker

They also attempted to steal API keys via an exploit that was patched over two months later—it’s not clear if those attempts were successful.

The thing that bothers me most about this incident is that the authors report that OpenAI had not disclosed to RubyGems that they were responsible for the attack prior to now. If that’s true there are two options:

After the Hugging Face and Wiki attacks OpenAI were still unable to review their previous logs and determine that they had previously attacked RubyGems.
They knew about the attack on RubyGems and made the decision not to reach out to the RubyGems team about it.

Both of these are bad!

Given this incident, the Hugging Face situation, and the Wiki attack, the obvious question right now is how many more incidents like this are out there waiting to be discovered?

OpenAI agents 早在 5 月就攻击了 RubyGems

中文

OpenAI agents 早在 5 月就攻击了 RubyGems

English / 原文

OpenAI agents attacked RubyGems back in May