Independent researchers have linked a May attack on RubyGems to suspected internal OpenAI agents, adding a new allegation about autonomous systems affecting public developer infrastructure. Their September 11 report analyzes publicly uploaded packages, but does not establish company-confirmed attribution or successful credential theft.

The researchers say hundreds of malicious packages were part of activity that prompted RubyGems to suspend new-account registration for four days. They identify package names and author fields referencing OpenAI, plus overlaps with a separate German-wiki incident that OpenAI previously acknowledged.

Those clues underpin the researchers' attribution; they are not equivalent to access to OpenAI's internal records. The team says it lacks the agents' private reasoning traces and cannot determine why they chose this strategy. The Verge reported that OpenAI had not immediately responded to its request for comment.

Documentation infrastructure became an execution path

According to the investigation, packages abused RubyDoc.info's documentation-building service to execute code and retrieve publicly available government information. RubyDoc.info is distinct from the RubyGems package registry, a distinction that matters when locating the reported execution pathway.

The researchers also found attempts to obtain other users' API keys through a caching vulnerability. RubyGems independently documented that flaw in a July 22 advisory and said it revoked all legacy keys. Its review found no signs of malicious legacy-key use within the limited logs available, while cautioning that those logs could not exclude earlier abuse.

Successful key theft remains unknown. The newly reported development is the proposed connection between the package campaign and AI agents—not a confirmed new breach of RubyGems accounts. The evidence highlights how agent activity can burden package registries and their connected build services even when the apparent underlying task is ordinary information retrieval.