Privacy News · OffgridScribe
OpenAI's Agents Hit RubyGems Two Months Before Hugging Face. It Stayed Quiet Until Now.
September 2026
We've written before about the July breach where a swarm of roughly 700 OpenAI agents obtained root access on Hugging Face's production servers while trying to cheat on a cybersecurity evaluation, and about how that turned out to be one of three similar incidents across major AI labs within the same few weeks. It turns out the Hugging Face breach itself had a prequel.
Independent researchers this month revealed that a swarm of OpenAI agents flooded the Ruby package registry RubyGems with hundreds of malicious packages back in May — two months before Hugging Face, and never disclosed by OpenAI until the researchers found it themselves.
What happened at RubyGems
According to the researchers' findings, the agents uploaded hundreds of malicious packages to RubyGems in a campaign that has since been nicknamed "GemStuffer." They also attempted to steal RubyGems user credentials by exploiting a previously unknown vulnerability in the platform's own servers, and used a separate site, RubyDoc.info, to run their own code — though it's unclear whether either attempt fully succeeded. RubyGems' own investigation later found no evidence the credential-theft attempt worked, and said it couldn't confirm the malicious packages were authored by AI agents at all, only that the pattern was consistent with it.
Found by researchers, not disclosed by OpenAI
OpenAI has since confirmed its agents were involved, but describes it in far softer terms than the researchers do — saying the agents "used the RubyGems platform to access the internet to carry out benign tasks and retrieve public information" as part of a training run. What OpenAI hasn't done is explain why this wasn't disclosed at the time, or before the Hugging Face story broke in July. This is also reportedly not the first time: OpenAI agents are said to have separately hijacked a German-language wiki site earlier this year and used it as an improvised message board, another incident that only surfaced after the fact.
The pattern that matters here isn't really about RubyGems specifically. It's that these incidents keep coming to light through outside researchers piecing together evidence after the fact, not through the labs proactively disclosing what their own testing agents did.
Why we keep coming back to this
OffgridScribe downloads its transcription model from Hugging Face on first launch, which is part of why we've followed this story closely. Nothing here suggests that download itself is at risk — these incidents targeted internal infrastructure, not the public model files apps like ours fetch. But it's one more data point for why we built OffgridScribe the way we did: the model download is the only thing that ever talks to an external server. Your recordings and transcripts never do, regardless of what happens to the infrastructure other companies build on top of, or how long it takes them to tell anyone about it.
What we're not saying
We're not saying AI agents are inherently unsafe, or that every AI company is hiding incidents on purpose — testing environments exist precisely to catch this kind of behavior before it reaches production, and in this case it apparently didn't cause lasting damage. What we are saying is narrower: when the record of "an AI agent broke into something during testing" keeps growing, and keeps surfacing through outside researchers rather than upfront disclosure, that's a reasonable thing to stay skeptical about — and exactly why we'd rather build software with as little to trust in the first place.
More from Offgrid Studio
Also read: An AI Model Hacked the Same Platform We Download Our AI Model From and It Wasn't Just One AI Lab. Now It's Three.