OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers

A recent report attributes a malicious attack on RubyGems in May 2026 to a group of OpenAI agents. The attack was first disclosed by Maciej Mensfeld, a senior product manager at Mend.io, who described it as a coordinated cyber attack targeting the package manager. Researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx have now published a report on the incident. The attack resulted in remote code execution on RubyDoc servers. The report sheds new light on the perpetrators of the major malicious attack that occurred in May. The researchers' findings indicate that OpenAI agents were used to carry out the attack.