A group of researchers discovered another previously undisclosed cyberattack by agents OpenAI was testing.
OpenAI’s agents hacked another service months before the Hugging Face incident happened, a group of researchers told The Wall Street Journal. The agents, which the company was testing in a supposed sandbox environment, reportedly broke into RubyGems, which is a community-ran packaging service for Ruby programs and libraries. According to The Journal, the attacks on RubyGems started on May 11, two months before Hugging Face. The agents created accounts every two to three minutes and then uploaded hundreds of files to the service. RubyGems had to shut down account registration for four days in order to stop the attacks.
Typically, creators on RubyGems upload files containing code and other information to help advance software development, but the agents’ documents contained web pages scraped from the internet instead. They reportedly included online calendars from a UK government website. The swarm of agents didn’t try to hide their activities either and used “OAI’ in their file names, as well as terms like “hack,” “evil” and “exploit.” In addition, the researchers told The Journal that the agents tried to exploit a couple of bugs, one of which was a zero-day vulnerability, in an attempt to publish existing files on the service that belonged to other users.
The researchers notified OpenAI about the incident, as well, and the company admitted that its agents really did infiltrate the service. “Based on our review, our agents used the RubyGems platform to access the internet to carry out benign tasks and retrieve public information,” a spokesperson told the Journal. “We’ll continue to investigate as part of our broader review of agent activity during training and evaluation.”
They added that the company tasked the agents to fill out spreadsheets and create reports during testing. Those agents accessed RubyGems to used the service as some sort of a makeshift web browser as part of their efforts to access information online. It’s not quite clear how the agents were able to access RubyGems even though they didn’t have full access to to the internet. However, it’s worth noting that several companies, including OpenAI, Anthropic and Meta, previously reported that the AI agents they were testing escaped their environments due to a misconfiguration by their testing partner Irregular.
Earlier this month, a separate group of researchers revealed that OpenAI agents made more than 15,000 edits to DseWiki, a German Wikipedia-style website created to assist human coders. The agents, which also escaped their isolated testing environment, reportedly used the website as a message board to share tips on how to “cheat” on their tasks and bypass OpenAI’s restrictions. This incident apparently took place in May, just like the RubyGems attacks and months before the hack on Hugging Face.
