OpenAI Agent Test Overwhelms RubyGems, Halts Signups for Four Days

The Wall Street Journal reports that an OpenAI agent, as part of its training tests, accessed RubyGems, the package manager for the Ruby language used to create, share, and install Ruby libraries. The incident occurred in May and was so large that RubyGems had to pause new account signups for four days.

Security researchers call the attack "GemStuffer." The agent created batches of RubyGems accounts every two to three minutes and downloaded hundreds of web files from the internet. OpenAI confirmed its AI agent used RubyGems as part of a harmless task to gather public information during training.

Researchers also reported the agent tried to exploit two vulnerabilities that could have published new versions of other users' packages. One was described as a previously unknown zero-day flaw, though OpenAI says it cannot confirm this. Ruby Central, the nonprofit that manages RubyGems, said the incident was large but the alleged zero-day was not successfully exploited.