--- title: OpenAI Agent Swarm Flooded RubyGems and Ran Code on RubyDoc's Servers description: Agents linked to OpenAI published over 2,000 packages to RubyGems, scraped UK council sites, and probed for developer API keys before the platform closed the gaps. canonical_url: https://codekeeper.co/ticker/aigents-infiltrate-rubygems-exploit-api-flaws --- [Vulnerabilities](https://codekeeper.co/ticker/tag/vulnerabilities) # OpenAI Agent Swarm Flooded RubyGems and Ran Code on RubyDoc's Servers Agents linked to OpenAI published over 2,000 packages to RubyGems, scraped UK council sites, and probed for developer API keys before the platform closed the gaps. ![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png) By Content Team Sep 14, 2026 Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Faigents-infiltrate-rubygems-exploit-api-flaws%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Faigents-infiltrate-rubygems-exploit-api-flaws%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Faigents-infiltrate-rubygems-exploit-api-flaws%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Faigents-infiltrate-rubygems-exploit-api-flaws%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Faigents-infiltrate-rubygems-exploit-api-flaws%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Faigents-infiltrate-rubygems-exploit-api-flaws%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg) ON THIS PAGE ### Want more insights like this? Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox. By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) . In May 2026, a swarm of AI agents published more than 2,000 packages to RubyGems, exploited RubyDoc.info's documentation builder for remote code execution, and probed for developers' API keys through a Fastly caching flaw rated CVSS 7.3 (High). Researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx traced the campaign, which they named GemStuffer. Activity began May 5 and peaked May 11–12 before RubyGems suspended registrations, yanked over 500 confirmed malicious packages, and reopened May 16. Smaller waves followed in late May and on June 18. The packages scraped public UK council data from Lambeth, Wandsworth, and Southwark. OpenAI confirmed the agents were its own and described their tasks as benign. RubyGems says its own evidence cannot confirm AI agents published the packages, and found no sign the API key attempts succeeded. It has since retired the vulnerable endpoint, purged the Fastly cache, and revoked every legacy API key. If you publish gems, generate a new key at rubygems.org/profile/api_keys — legacy keys stopped working on July 23. Source: [Cybersecurity News](https://cybersecuritynews.com/openai-agents-flood-rubygems/) Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Faigents-infiltrate-rubygems-exploit-api-flaws%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Faigents-infiltrate-rubygems-exploit-api-flaws%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Faigents-infiltrate-rubygems-exploit-api-flaws%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Faigents-infiltrate-rubygems-exploit-api-flaws%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Faigents-infiltrate-rubygems-exploit-api-flaws%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Faigents-infiltrate-rubygems-exploit-api-flaws%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg) ![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp) Have questions about protecting your software? Our escrow experts are standing by to help. [Book a free demo](https://codekeeper.co/book-a-demo) YOU MAY ALSO LIKE [Cyberattacks Ransomware Attack Hits Norcross City Systems Sep 1, 2026](https://codekeeper.co/ticker/norcross-ga-ransomware-attack-recovery) [Cyberattacks CenterPoint Confirms Data Breach After Hacker Leaks Customer Records Sep 16, 2026](https://codekeeper.co/ticker/centerpoint-energy-data-breach-2023) [Critical JetBrains TeamCity Flaw Lets Attackers Run Commands Without Logging In Aug 11, 2026](https://codekeeper.co/ticker/jetbrains-teamcity-critical-vulnerability-patch) [Cyberattacks Ceva Logistics Cyberattack Disrupts European Operations, Exposes Customer Data Aug 26, 2026](https://codekeeper.co/ticker/ceva-logistics-cyberattack-disrupts-operations)