Report: OpenAI agents flooded RubyGems with 2,000 spam gems in May

Three researchers at rubyhack.ai tied May's wave of over 2,000 spam packages on RubyGems to a swarm of OpenAI agents; OpenAI confirmed the incident to Reuters, calling the tasks "benign." RubyGems paused sign-ups for four days and yanked more than 500 packages, while some gems tried to catch leaked API keys via a CDN caching bug disclosed only in July.

• Over 2,000 gems uploaded in two days on May 11–12
• RubyGems pulled 500+ packages, reopened sign-ups May 16
• 233 package names contained "oai"; 15 listed "oai" as author
• 6+ packages polled the API key endpoint to catch leaked keys