How it happened

As of 8 October 2026

A step-by-step account of what the sources say the packages did, and of what the link to OpenAI rests on. Each step names who says it, because some steps are RubyGems' own account and others are the researchers' or security firms'.

A few terms first

A package registry is a public online library where programmers publish reusable code for others to install. rubygems.org is the main one for the Ruby language, and each unit of code is called a gem or a package. To yank a package is to pull it so that it can no longer be installed from the library. An API key is a secret code that lets software act as a particular user, for example to publish packages. RubyDoc.info is a separate service that builds documentation pages for Ruby packages ^[1][2].

Step 1: create many accounts

The researchers and The Hacker News report that accounts were registered at scale using disposable email addresses, meaning throwaway addresses, and that a bug, since fixed, gave working API keys without checking the email address reported ^[2][3]. Mend.io, which flagged the flood on 11 May, describes thousands of accounts ^[4].

Step 2: publish packages in bulk

Each account pushed many packages. Some were empty; some held scripts and probes with names such as hack.rb, exploit.rb and evil.rb reported ^[5][3]. Names like these are why RubyGems called the packages malicious; OpenAI describes the activity it reviewed as benign. Neither account has been independently verified (see the callout below).

Step 3: get code run on shared infrastructure

For more than 100 packages, publishing the package and then requesting its documentation made RubyDoc.info read a file called .yardopts, a settings file for the documentation build, that pointed to Ruby scripts. The researchers say this ran the scripts on RubyDoc.info's servers reported ^[2][3]. RubyGems confirms the general design: packages meant to run code on shared Ruby infrastructure ^[1].

Steps 4 and 5: fetch public pages, then send the data out through the registry itself

Those scripts requested public websites, mainly UK council portals that publish meeting information reported ^[2][6][7]. The fetched data was packed into a new package and published back to rubygems.org, where whoever ran the campaign could download it with the `gem fetch` command; some variants tried to hold data in webhook settings, which are web addresses a service calls automatically reported ^[7][6][2].

No source opened shows private data being taken. The data described is public council information ^[2][6][7].

Step 6: attempts to catch other users' API keys

On 12 May, at least six packages repeatedly queried an old API-key address on the registry. JFrog describes the queries as an attempt to obtain other users' registry API keys, and the researchers connect them to a caching flaw. Whether this worked is unresolved reported ^[2][6][8]. A cache, here run by a content delivery network, is a layer of servers that keeps copies of replies to answer faster; the flaw could expose one user's key to another.

RubyGems' advisory confirms the flaw itself: it was reported by the security firm Truffle Security on 6 July 2026 and fixed on 9 July ^[9]. RubyGems says there is “no evidence that these attempts succeeded” ^[1], and its advisory says it “found no sign of a legacy key being used maliciously”, while noting that its logs cover only a recent window, so abuse cannot be ruled out ^[9].

Other probes

JFrog and Mend.io also saw package metadata containing XSS and template-injection strings, which are pieces of text crafted to make a web page or template run something it was not meant to reported ^[6][4].

What links this to OpenAI

The link is the researchers' inference, not a finding by RubyGems. Their evidence, as reported:

• Hundreds of package names contain “oai”, and 15 list “oai” as the author reported ^[2][10]
• One package lists a Gmail contact address containing “openai” reported ^[2][10]
• The June packages touched 49 of the same files as a separate German-wiki incident that OpenAI has acknowledged reported ^[2]
• The researchers also link the naming scheme and tools to the Hugging Face incident, which is covered in its own report reported ^[2][3]