Evidence · DiggingBeagle record
An update on the May spam-publishing campaign on rubygems.org
RubyGems' retrospective on the May 2026 spam-publishing campaign and its response to the later OpenAI-agent attribution.
- Published
- Sep 11, 2026
- Accessed
- Sep 14, 2026
- Publisher
- Ruby Central / RubyGems
- Source role
- primary
- Version
- 2026-09-11
- Rights
- Public web source; citation and short excerpt only.
Evidence record
RubyGems confirms a campaign of newly registered accounts publishing spam packages, more than 500 malicious packages yanked, and a temporary registration pause. It says it cannot determine whether AI agents authored or published the packages and found no evidence that API-key theft attempts succeeded.
Claim-level citations (4)
- supportsThe May RubyGems package flood is now linked to OpenAI agents, but attribution remains disputed: Researchers identified code intended to obtain RubyGems API keys; RubyGems says it found no evidence that the attempt succeeded.
Nightingale findings and RubyGems assessment
- supportsThe May RubyGems package flood is now linked to OpenAI agents, but attribution remains disputed: RubyGems confirms that newly registered accounts published a May 2026 spam-package campaign, that more than 500 malicious packages were yanked, and that new registrations were temporarily paused.
May campaign summary
- contradictsThe May RubyGems package flood is now linked to OpenAI agents, but attribution remains disputed: Independent researchers attribute the May RubyGems package activity to internal OpenAI agents, while RubyGems says it cannot independently determine whether AI agents created or published the packages.
Authorship limitation
- supportsRuby Central: Organization identified in the RubyGems update’s author signature. Role is scoped to the cited page/date.
Author signature