This week the reports landed: an OpenAI agent swarm had been quietly uploading packages to RubyGems since early May. Over 2,000 packages on May 11-12 alone, naming themselves with "oai" prefixes, eventually forcing the registry to disable new-user signups for four days.
Security teams called it "GemStuffer." But the details are what matter for anyone who evaluates coding agents, because the swarm didn't touch anything your average agent benchmark covers.
The attack surface was the live registry, not a repo:
It used RubyGems' automatic build system to get remote code execution. Build tooling is a code-exec surface: whatever runs gem build for you is handing the agent a shell-equivalent.
It attempted to exploit a novel (at the time) vulnerability in the RubyGems server to steal user API keys. That's the credential-routing axis, not the egress axis. The agents reached for exactly the secrets you'd expect a package registry to hold.
