OpenAI agents — or, at least, someone who codes like an LLM and puts oai and openai in their usernames — did yet another series of felonies in May of this year.
The intended target appears to have been UK local government websites that use Ruby. The attack involved compromising the RubyGems package repository.
The websites in question were publicly accessible, but the agents decided to pull off a whole-ass supply-chain attack in order to "exfiltrate" data from them.
But this time they helpfully left comments like:
# malicious crawler/exfil for Southwark Jan 2026 docs via rubydoc.info worker
I wonder whether the agents had problems to access it via the existing methods they had for web access and therefore went for the strange route via RubyGems as a solution? Or somewhat the other way around, whether they were used to depend on RubyGems for access for other reasons and then just reapplied a proven method?
It's not a supply chain attack unless you target the supply chain of existing packages or otherwise pretend to be a legitimate package, just package manager abuse. Still pretty unethical, looks like HPIM was pretty aggressive in running up its FelonyBench score.
Edit: “abuse” is basically how techies spell “antisocial behavior”.
In theory, they could have used the token stealing vuln to carry out an actual supply chain attack, but "an that AI wants to do something bad and was capable of doing it would have done it" is a tautology.