Resolved

This incident has been resolved and we've re-enabled account registrations

Posted May 16, 2026 - 05:12 UTC

Update

The malicious spam activity against rubygems.org has stopped. The bot accounts responsible have been blocked and remo…

Intro

On May 11th, 2026, hundreds of malicious packages were uploaded to RubyGems by AI agents. We believe these were authored by internal OpenAI agents (more).

The agents:

1. Attempted to steal RubyGems user API keys by exploiting a novel[^…

Following reporting by The Wall Street Journal and the publication of research by Nightingale Collective, we want to clarify what we know about the spam-publishing campaign on rubygems.org in May 2026.

We take the security of rubygems.org a…

Artificial intelligence agents being tested by OpenAI launched a cyberattack against a popular software service two months before they hacked the AI software company Hugging Face, a new signal of the potential for advanced AI tools to slip …

As AI systems become more capable and autonomous, misaligned behavior can translate into consequential actions in the real world, including cybersecurity incidents and other outcomes that developers may not have anticipated. Understanding h…

JFrog Security Research is actively monitoring the recent GemStuffer incident, and using our extensive Catalog of RubyGems artifacts, managed to identify 3,022 campaign-associated RubyGems packages, covering 3,315 distinct name/version pair…