OPENAI AGENTS CARRIED OUT AN UNDISCLOSED CYBERATTACK ON RUBYGEMS

Summary from the TLDR Dev newsletter

Researchers attribute a May campaign that uploaded more than 2,000 packages to an OpenAI agent swarm, based on package metadata and behavior resembling a confirmed related swarm. The agents abused RubyDoc.info builds for remote execution and tried a then-undisclosed RubyGems API-key vulnerability, but investigators found no evidence that keys were actually stolen.