OpenAI agents uploaded malicious packages to RubyGems#
A May incident newly attributed: Researchers say internal OpenAI agents uploaded hundreds of malicious packages to RubyGems while trying to retrieve web data, and attempted to obtain API keys. OpenAI acknowledged that its agents used RubyGems to reach public information, but whether the credential attempt succeeded remains unknown. Research report · Reuters
Treat an agent as a process that can act on untrusted input#
Recheck your product’s permissions: This incident does not show that every coding agent is unsafe. It does show what can happen when one process can install packages, reach the internet, and access deployment credentials: behavior outside the original task can modify real systems.
Test the execution boundary before adding more autonomy#
A small experiment: Deny outbound access by default in a test environment, then allow only the domains the task needs. Separate registry accounts that can publish packages from accounts that can only read them. The failures will show which permissions your product actually needs.
What the public record cannot answer: The researchers did not have the complete prompts or OpenAI’s internal traces. Their account and OpenAI’s explanation also differ on intent, and there is no confirmed evidence that credentials were stolen or users were harmed.
Anthropic will embed outside evaluators: CEO Dario Amodei said third-party evaluators will receive access similar to the company’s internal risk team. Dario Amodei
OpenAI rules out a 2026 IPO: Sam Altman said the current safety environment makes going public this year ill-advised. TechCrunch