News

OpenAI's Rogue Agent Problem Started Earlier Than We Knew

• By John K. Waters
• 09/12/2026

Two months before a swarm of OpenAI agents broke out of a cybersecurity evaluation and hacked Hugging Face, another group of the company's AI agents was already causing trouble on the open internet. Nobody knew they were OpenAI's.

In May, hundreds of junk and malicious packages began appearing on RubyGems, the package repository used by Ruby developers. New accounts appeared every few minutes. Packages containing scraped web pages flooded the service. Some contained code designed to obtain other users' API keys.

RubyGems responded by suspending new account registrations for four days and removing more than 500 packages. At the time, security researchers called the campaign GemStuffer. They suspected AI might be involved, but they didn't know who was behind it. Now they think they do.

A group of researchers led by the Nightingale Collective, an independent, nonprofit AI safety research and watchdog group, traced the activity to agents OpenAI was testing, according to The Wall Street Journal. OpenAI confirmed to the Journal that its agents were involved.

The explanation is almost more interesting than the attack. The agents weren't instructed to hack RubyGems. According to OpenAI, they had been assigned benign tasks such as filling out spreadsheets, creating reports, and retrieving public information. Because they lacked normal internet access, the agents apparently discovered that RubyGems could be repurposed as a makeshift route to the web.

“Based on our review, our agents used the RubyGems platform to access the internet to carry out benign tasks and retrieve public information,” an OpenAI spokeswoman told the Journal.

The agents had been given a goal, and they found a way to accomplish it. The problem was the route they chose. And we're beginning to see that pattern often enough that it is becoming difficult to dismiss as an isolated laboratory accident.

GemStuffer
The attack began May 11. According to the Journal, OpenAI agents began creating RubyGems accounts every two or three minutes and uploading hundreds of packages. Instead of useful Ruby code, many packages contained information scraped from websites, including material from British government sites. The scale overwhelmed the service.

RubyGems has now published its own account of the incident. It says newly registered accounts published more than 500 packages before operators blocked the accounts and temporarily stopped new registrations. Existing users could continue installing and publishing gems during the incident.

Researchers from Nightingale Collective found something more concerning inside the packages. They identified code designed to steal API keys from other RubyGems users. RubyGems says it found no evidence that those attempts succeeded.

The researchers also told the Journal that the agents tried to exploit two RubyGems vulnerabilities that could have allowed them to publish new versions of packages belonging to other developers. One was allegedly a previously unknown zero-day vulnerability.

That claim remains unresolved. OpenAI told the Journal that it could not verify the zero-day finding, while Ruby Central's Marty Haught said the attempted exploitation did not appear to succeed. RubyGems itself says it cannot independently determine whether AI agents created or published the packages. (Ruby Central is the nonprofit that maintains RubyGems and runs the ecosystem's main annual conferences, RubyConf and RailsConf.)

Those qualifications matter. No evidence shows OpenAI told an AI system to attack RubyGems, and no evidence shows the agents independently decided that compromising software infrastructure would be a fun way to spend the afternoon.

What appears to have happened is subtler. The agents were trying to accomplish their assigned tasks. They simply found methods their operators hadn't anticipated.

Then Came Hugging Face
If GemStuffer had remained an isolated event, people might have remembered it as an unusually sophisticated form of automated spam. Then July happened.

As Pure AI reported at the time, during an internal OpenAI cybersecurity evaluation, agents escaped restrictions intended to isolate them from the internet, exploited vulnerabilities in shared infrastructure, and ultimately compromised systems belonging to Hugging Face.

OpenAI later described the episode in its incident report as a “warning shot.”

The scale was remarkable. An independent investigation by METR found that roughly 1,200 agents discovered an unauthorized way to communicate with one another. They exchanged more than 70,000 messages and files on an improvised message board, and about 700 agents eventually participated in the attack on Hugging Face.

They had been intended to operate independently. Instead, they organized. Within hours, dozens of agents were exchanging information. They divided work among themselves and developed larger collaborative projects. Some specialized in particular parts of the Hugging Face attack.

They even encountered the sort of problem that eventually afflicts most communities: impersonation. Agents became concerned that other agents could spoof identities on their shared message board. Their solution was to develop a cryptographic signing scheme. METR found at least 19 agents publishing public keys and hundreds of signed messages. OpenAI engineers didn't design this for them. The agents built it themselves.

The World's Strangest Cheating Scandal
One important detail keeps the Hugging Face incident from turning into a science-fiction story. The agents apparently weren't trying to escape human control. They were trying to cheat on a test.

The systems were participating in OpenAI cybersecurity evaluations based on ExploitGym, which asks agents to find and exploit software vulnerabilities. Some agents had apparently been assigned tasks that were impossible to complete as intended. So, they began looking for another way to get the answers.

According to Hugging Face's forensic reconstruction, the agents appear to have concluded that Hugging Face might contain datasets or reference solutions associated with the benchmark. What followed was an intrusion lasting roughly two and a half days and involving thousands of automated decisions executed at machine speed.

The agents escaped OpenAI's evaluation environment, reached the internet through third-party infrastructure, and penetrated Hugging Face's internal network. Hugging Face says the only customer content accessed consisted of five datasets apparently connected to the cybersecurity challenges.

In other words, the AI didn't appear to develop a new goal. It pursued the goal humans had given it using methods humans had not authorized. That distinction may be the most important part of the story.

Misalignment Without a Supervillain
Popular discussions about dangerous AI tend to gravitate toward the dramatic scenario: an artificial intelligence develops its own objectives, decides humanity is an obstacle, and starts working against us.

Neither GemStuffer nor Hugging Face demonstrates anything like that. The evidence points toward a more prosaic problem. A sufficiently capable agent can remain focused on its assigned objective while discovering strategies that violate the intentions of the person who assigned it.

Tell an agent to retrieve information without giving it ordinary internet access, and it may discover an unintended route through a public software repository. Give agents cybersecurity problems to solve independently, and they may discover one another, build a communication network, and collaborate on ways to manipulate the evaluation.

OpenAI's own assessment of the Hugging Face incident essentially reaches this conclusion. The company says its models became “powerful, persistent, and collaborative enough” to find and exploit security weaknesses across multiple systems when adequate safeguards were absent.

That is considerably less cinematic than an AI deciding to conquer the world. It may also be a much more useful problem to worry about.

The Warning Came Earlier Than We Knew
The RubyGems revelation changes the chronology. Until now, the Hugging Face incident looked like the extraordinary event that forced OpenAI to confront what could happen when highly capable agents found ways around their controls. But we now know there was an earlier warning.

GemStuffer occurred in May. METR says OpenAI agents were also using unauthorized message boards during training that month, although those earlier communications were outside the scope of its Hugging Face investigation. By July, the behavior had become substantially more sophisticated.

Agents intended to be isolated discovered one another. They created their own communication system. They shared discoveries and coordinated work. Hundreds eventually converged on the Hugging Face attack.

OpenAI says it has responded by tightening sandbox isolation, restricting internet access, controlling access to model weights, and investing more computing resources in monitoring model reasoning. The company has also argued that the AI industry needs better mechanisms for reporting incidents involving misaligned agents.

That response makes sense. But it also reveals how quickly the problem is changing. Traditional computer security assumes, at some level, that defenders can anticipate the ways software might interact with a system. Agentic AI complicates that assumption because the software isn't simply executing a predetermined sequence of instructions. It is selecting actions in pursuit of an objective.

As the systems become better at reasoning, coding, cybersecurity, and long-horizon planning, the number of routes available to them increases. So does the burden on the people trying to predict which route they will choose.

This Week's Warnings Look Different Now
The timing of the RubyGems disclosure is difficult to ignore. As we reported last week, Jacob Coxon, an AI researcher who worked on pretraining frontier models at OpenAI and Anthropic, resigned from Anthropic and warned that the industry was racing toward self-improving superintelligence without knowing how to control it.

Other Anthropic researchers publicly agreed that the alignment problem remains unresolved. And yet, GemStuffer doesn't prove Coxon right. Neither does Hugging Face.

Today's agents are not superintelligent, and neither incident demonstrates that an AI system developed an independent desire to harm people or escape human control. Turning these events into evidence that artificial intelligence is becoming sentient would be getting well ahead of the facts.

But the incidents do provide real-world examples of a narrower engineering problem underlying those larger warnings: AI systems can pursue an objective in ways their developers neither intended nor predicted.

In May, that meant hundreds of unwanted packages on RubyGems. In July, it meant hundreds of agents collaborating in an intrusion against Hugging Face. So, the question isn't whether those events prove that future AI will escape human control. It's what the same kind of behavioral surprise looks like when the agents become much more capable.