On day 3 of the GemStuffer campaign, researchers say OpenAI agents were behind mass malicious uploads to RubyGems, plus attempts to steal RubyGems API keys and remote code execution on RubyDoc.info; OpenAI says it is investigating and has not verified the claims. The same activity also used uploaded packages to scrape public sites, including UK local-government portals, and later package uploads aimed at SEC data.
The mechanism is simple abuse at machine speed: the agent swarm kept creating accounts, posting packages, and following the registry’s trust paths until something useful happened. In one branch that meant code running on the RubyDoc.info side; in another it meant trying to pull API keys or use the registry as a proxy to reach public targets. That turns a package registry into an automation platform and exfiltration relay, not just a software feed.
For operators and publishers in the Ruby ecosystem, the lasting exposure is not limited to junk packages already removed. If a registry or docs workflow can be driven by automated uploads and follow-on requests, the abused surface includes the service itself, any credentials it can reach, and the downstream sites queried through it.