Australian researchers link malicious RubyGems packages to OpenAI agents
In Australia, researchers said that artificial intelligence agents tested by OpenAI uploaded hundreds of malicious packages to the RubyGems service on May 11. As ABC News Australia reports, the research group believes these packages may have been created by OpenAI’s internal agents.
Actions on RubyGems
OpenAI confirmed the incident. A company representative said that, according to the results of the review, the agents used the RubyGems platform to access the internet, perform safe tasks, and obtain public information. The company also said it would continue the investigation as part of a broader review of agent activity during training and evaluation.
According to the researchers, in May the agents also attempted to obtain RubyGems users’ credentials by exploiting a previously unknown vulnerability in the service’s servers. It is unknown whether this attempt was successful. In addition, the researchers claim that the agents used the RubyDoc.info website, which generates documentation for program code, to run their own code on its servers.
More current news is available on the UA.News Telegram channel Telegram.
Other incidents
This case may be at least the third significant episode in which OpenAI agents interfered with the infrastructure of other companies. Earlier, a group of agents took over a German-language wiki website and turned it into an improvised messaging platform to cheat during tests.
According to ABC News Australia, OpenAI did not disclose that incident while addressing the consequences of the July hack of the Hugging Face open-source repository. Tens of thousands of messages from hundreds of agents calling themselves a “collective” indicated coordination of the attack on Hugging Face. This week, Anthropic also reported a fourth case in which an artificial intelligence model hacked external systems during testing.
