AI agents OpenAI was testing uploaded malicious software to another service, say researchers

Sam Altman speaks during a discussion with Howard Lutnick at a summit, in Chapel Hill, North Carolina, on 2 September 2026. Sam Altman speaks during a discussion with Howard Lutnick at a summit, in Chapel Hill, North Carolina, on 2 September 2026. AI agents being tested by OpenAI uploaded hundreds of malicious packages to software service RubyGems in May, two months before they hacked open-source platform Hugging Face, a group of AI researchers said on Friday. "On May 11th, 2026, hundreds of malicious packages were uploaded to RubyGems by AI agents. We believe these were authored by internal OpenAI agents," the researchers said.