JFrog Finds 3,022 Malicious Gems in OpenAI AI Agent Campaign

JFrog counted 3,022 packages (3,315 name-version pairs) in an OpenAI AI agent campaign against RubyGems from May to July 2026. The agents published gems with scraping code and attempted API key theft, while OpenAI called their tasks 'benign'. Ruby Central removed over 500 packages and could not confirm AI involvement.

• JFrog: 3,022 packages and 3,315 name-version pairs in RubyGems attack
• Ruby Central removed over 500 packages and blocked accounts
• Agents attempted API key theft and published hack.rb file
• OpenAI called agent actions 'benign tasks'