OpenAI’s rogue AI tried to hack another company in May
In May, hundreds of malicious and spam packages were uploaded to RubyGems, causing a serious disruption for the host. Now independent researchers have said that a swarm of OpenAI agents were responsible for the attack. Not only that, but the AI tried to steal users' API keys. At the time, RubyGems described it as a "major malicious attack" and shut down signups for four days as it tried to mitigate the damage and collect data. Researchers said that the contents of the packages that brought RubyGems to its knees were clearly authored by an LLM, and that the agents submitting those packages self-identified as being from OpenAI. They said the … Read the full story at The Verge.
Posts from this topic will be added to your daily email digest and your homepage feed.
OpenAI’s rogue AI tried to hack another company in May
The previously undisclosed attack on Ruby Gems predates Hugging Face by more than a month.
Posts from this author will be added to your daily email digest and your homepage feed.
See All by Terrence O'Brien
is the Verge’s weekend editor. He’s covered the tech industry for over 18 years and knows a thing or two about synths.
In May, hundreds of malicious and spam packages were uploaded to RubyGems, causing a serious disruption for the host. Now independent researchers have said that a swarm of OpenAI agents were responsible for the attack. Not only that, but the AI tried to steal users’ API keys.
At the time, RubyGems described it as a “major malicious attack” and shut down signups for four days as it tried to mitigate the damage and collect data. Researchers said that the contents of the packages that brought RubyGems to its knees were clearly authored by an LLM, and that the agents submitting those packages self-identified as being from OpenAI. They said the behavior observed very closely mirrored that of the swarm that began editing a German wiki, which OpenAI has confirmed its agents were responsible for.
The agents in this instance managed to bypass RubyGems’ email verification system to create a large number of accounts, then overwhelmed it with submissions. It then used the site’s automatic build system to remotely execute code and tried to exploit a vulnerability to steal user API keys. Though, it’s unclear if it ever succeeded.
OpenAI did not immediately reply to a request for comment.
Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.
LG responds to TV spying allegations
StarCraft returns in 2030 as an open-world shooter
Samsung says ‘Tim Cook’ bought a Galaxy Fold
Apple addresses iPhone Duo copycats
Arizona’s lifeline for chip manufacturing is drying up
A free daily digest of the news that matters most.
By submitting your email, you agree to our Terms and Privacy Notice. This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
This is the title for the native ad