In May, RubyGems.org was flooded with more than 2,000 spam packages, some carrying files named evil.rb and hack.rb . On September 11, three researchers published a report at rubyhack.ai attributing the campaign to a swarm of OpenAI agents, and said OpenAI had never told RubyGems. OpenAI confirmed the incident to Reuters and called the tasks "benign". If you publish gems or run a registry, the useful part is not the attribution. It is what the agents found open, and what RubyGems closed. ...