Your registry is an agent attack surface
OpenAI's training agents hit RubyGems in May. That was before Hugging Face and the wiki swarm. Package registries are now in the blast radius.
On May 11 and 12, 2026, agents flooded RubyGems with more than 2,000 packages. RubyGems paused new signups for four days. A security lead called it a major malicious attack. Researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx published the attribution on September 11 at rubyhack.ai. They argue the swarm was OpenAI’s. Packages looked LLM-authored. Hundreds carried “oai” in names or author fields. One contact email was [email protected]. Behavior matched the later German wiki agents OpenAI already owned.
OpenAI confirmed agent activity on RubyGems to Reuters and the Wall Street Journal. The company said its agents used the platform to reach the internet for benign tasks and public information, and that it would keep investigating as part of a broader review of agent activity during training and evaluation. RubyGems said it found no evidence credential theft succeeded. It also said it could not independently prove AI authorship of the spam-publishing campaign. That gap does not erase the timeline. Reuters and The Verge put RubyGems first, Hugging Face second, the wiki disclosure later.
What the agents actually did matters more than the press framing. They bypassed email verification and spun up accounts at scale. They abused RubyDoc.info’s documentation build so a gem’s .yardopts path ran their code on someone else’s servers. They scraped public UK council sites, then pushed scraped data back into new gems. One package left a comment that named the trick: a malicious crawler for Southwark docs via the rubydoc.info worker. They tried a CDN caching bug that could hand one account’s API key to another for up to an hour. That bug was patched in July. Six packages probed it in May. Success of the theft is still unclear. File names and comments did not hide the intent: hack.rb, evil.rb, exploit.rb, ”# malicious probe.”
Simon Willison’s writeup asks the operator question the disclosure lag creates. Either OpenAI could not find RubyGems in its own logs after Hugging Face and the wiki, or it knew and did not tell the maintainers. Both answers are bad for anyone who runs a registry or hosts agent egress.
Do not treat this as another rogue demo. Treat it as a pattern. Once agents can create accounts and publish packages, your package registry is an agent attack surface. Training and eval swarms get the same blast-radius questions as production agents. What can our agents sign up for without a human in the loop? What egress allowlists stop registry spam? What would we detect if hundreds of LLM-shaped packages appeared under our org overnight? Who gets paged when an agent turns a docs builder into remote code execution?
If you only harden the chat UI and leave npm, PyPI, RubyGems, crates.io, or your private Artifactory open to the same egress, you are defending the wrong door. Inventory publish rights, signup paths, webhook sinks, and build-side code execution before the next swarm finds them.