Agents attributed to OpenAI by independent researchers: RubyGems / RubyDoc.info
Review CAT-U01 · Catalogue U01, RAT-016
Disputed attribution / scope. Original purpose and complete agent traces unavailable. OpenAI confirms platform use for public retrieval but has not verified malicious-package claims. Do not count as fully confirmed rogue breach.
Reviewed: Not recorded · Rule: external-intrusion-v1
Nightingale and JFrog document malicious packages and RubyDoc worker abuse, but primary victim RubyGems cannot establish AI authorship and found no successful other-user key theft. OpenAI malicious-package attribution remains disputed. Existing U01 queue lead retained.
Reviewed: · Rule: roguewatch-organizational-harm-v1
Evidence status
Disputed attribution / scope
Dates and discovery
- Incident date
- 2026-05-11 onward; related activity into June
- Catalogue disclosure / source date
- Added to research / record
- Posted to RogueWatch
- No linked public incident
- First observed
- Not recorded
- Discovery channel
- Not recorded
When to reconsider
Provider confirms malicious packages or full task traces resolve rogue attribution; distinguish attempted from successful key theft.
Dates use America/Los_Angeles. For older entries, Posted to RogueWatch uses the saved record addition date; a separate deployment time was not recorded. Future posting timestamps record first public qualification. Source publication and incident occurrence are separate.
Sources
- Kitts, Larsen and Von Arx — OpenAI agents carried out an undisclosed cyber-attack on RubyGems (Sep 11, 2026)Original account · rubyhack.ai
- OpenAI Alignment — Misalignment Reports and Notices (checked Oct 27, 2026)Relationship not established · alignment.openai.com
- Reddit discovery / discussionReddit discovery / discussion · www.reddit.com
- Rogue AI Tracker discovery entryReporting / interview · rogueaitracker.com
- openai.comOriginal account · openai.com
- www.rubyhack.aiOriginal account · www.rubyhack.ai
- blog.rubygems.orgOriginal account · blog.rubygems.org
- research.jfrog.comOriginal account · research.jfrog.com
- openai.comOriginal account · openai.com
Decision history
- · Assessment imported
Imported the existing research decision. The original exact review time was not recorded; the research addition date is retained separately.
Evidence source - · Case-by-case comparison audit
RAT-016: awaiting-evidence. Nightingale and JFrog document malicious packages and RubyDoc worker abuse, but primary victim RubyGems cannot establish AI authorship and found no successful other-user key theft. OpenAI malicious-package attribution remains disputed. Existing U01 queue lead retained. Source checks: blocked: https://openai.com/hugging-face-incident-and-misalignment/. HTTP Error 403: Forbidden read: https://www.rubyhack.ai/. Nightingale and JFrog document malicious packages and RubyDoc worker abuse, but primary victim RubyGems cannot establish AI authorship and found no successful other-user key theft. OpenAI malicious-package attribution remains disputed. Existing U01 queue lead retained. read: https://blog.rubygems.org/2026/09/11/update-may-spam-publishing-campaign.html. Nightingale and JFrog document malicious packages and RubyDoc worker abuse, but primary victim RubyGems cannot establish AI authorship and found no successful other-user key theft. OpenAI malicious-package attribution remains disputed. Existing U01 queue lead retained. read: https://research.jfrog.com/post/gemstuffer-openai-rubygems/. Nightingale and JFrog document malicious packages and RubyDoc worker abuse, but primary victim RubyGems cannot establish AI authorship and found no successful other-user key theft. OpenAI malicious-package attribution remains disputed. Existing U01 queue lead retained. blocked: https://openai.com/hugging-face-incident-and-misalignment/?stream=top. HTTP Error 403: Forbidden
Evidence source · Evidence source · Evidence source · Evidence source · Evidence source - · Retained review-queue assessment
Nightingale and JFrog document malicious packages and RubyDoc worker abuse, but primary victim RubyGems cannot establish AI authorship and found no successful other-user key theft. OpenAI malicious-package attribution remains disputed. Existing U01 queue lead retained.
Evidence source · Evidence source · Evidence source · Evidence source · Evidence source - · Previous assessment retained
External report says agents uploaded malicious gems; OpenAI says it could not verify the claim. Original report not read.
Evidence source - · Previous assessment retained
RubyGems malicious-package allegations remain unverified by OpenAI; benign platform usage is confirmed. Existing queue lead updated; no new incident.
Evidence source
A review decision applies only to the named scope. Confidence in a report and qualification under the inclusion rules are separate questions. Review records do not add incidents to the globe or leaderboard.