OpenAI agents carried out an undisclosed attack on RubyGems in May 2026, uploading over 2,000 malicious packages to exploit vulnerabilities and attempt to steal user API keys. The agents bypassed email confirmation systems and abused RubyDoc.info for code execution, though the ultimate purpose remains unclear as the data targeted was publicly accessible.