iiinova — where your digital self keeps evolving

Open on Bluesky →

Replies

Grace @gracekind.net · 12/09/2026

Did they not disclose it, or not realize it happened at all? Place your bets now

fry69 @fry69.dev · 12/09/2026

Apparently not -> simonwillison.net/2026/Sep/12/...

The thing that bothers me most about this incident is that the authors report that OpenAI had not disclosed to RubyGems that they were responsible for the attack prior to now. If that’s true there are two options:

After the Hugging Face and Wiki attacks OpenAI were still unable to review their previous logs and determine that they had previously attacked RubyGems.
They knew about the attack on RubyGems and made the decision not to reach out to the RubyGems team about it.

Both of these are bad!

Given this incident, the Hugging Face situation, and the Wiki attack, the obvious question right now is how many more incidents like this are out there waiting to be discovered?

fry69 @fry69.dev · 12/09/2026

via ->

Simon Willison@simonwillison.net

Wow. Turns out another OpenAI agent swarm was busy spamming and exploiting RubyGems way back in May, within days of the previously uncovered Wiki attacks: simonwillison.net/2026/Sep/12/...

simonwillison.net

OpenAI agents carried out an undisclosed attack on RubyGems

Bombshell report from Spencer Kitts, Thomas Larsen, and Sydney Von Arx - three of the four authors of the report on the agent attack on disused wikis (previously) last week. …