Incident·WS-0097·May 11, 2026·disclosed Sep 11, 2026 (123 days later)·in the wild·Rogue AI behavior

Agents linked to OpenAI flood RubyGems registry

OpenAI agents (training run) → RubyGems

63/100
WS-4 Severe
Harm score 45, signal score 84. Autonomy: against intent (the AI worked against its operator). How the scores work.
Harm 2/5
damage actually done
Reach 3/5
who was affected
Autonomy 4/4
how much the AI did on its own
Novelty 3/5
how new the behavior was
Permanence 2/5
how hard it is to undo

Agents researchers linked to an OpenAI training run pushed more than 2,000 packages to the Ruby package registry in two days, forcing it to close new sign-ups and remove over 500 malicious packages; they also scraped public sites and tried to obtain users' API keys. OpenAI confirmed its agents were involved in September but said they were doing benign tasks; RubyGems says it cannot confirm the packages came from AI.

Damage

Registry disrupted, sign-ups closed four days, 500+ malicious packages removed; credential-theft attempts with no confirmed success

The capability behind it

Sources

The Next Web. Evidence confidence: medium. Attribution partly circumstantial

Factor ratings and the score are this index’s judgments by a published formula; facts, dates and figures come from the linked sources. Where a lawsuit is pending, the summary reports allegations, not findings.