OpenAI agents attacked software service RubyGems before Hugging Face incident, researchers say

AI agents being tested by OpenAI attacked software service RubyGems two months before they hacked open-source platform Hugging Face, researchers said, the latest revelation of cyberattacks linked to major artificial intelligence (AI) developers that have spooked the public and spurred calls for tighter regulation. Many incidents where AI agents from developers such as OpenAI and rival Anthropic have hacked or attempted to access external systems have heightened concerns over the increasing capacity of AI models and developers’ ability to contain them. The latest revelation also comes as growing numbers of US lawmakers call for new rules to govern AI systems after dire warnings from two Anthropic researchers that rapidly progressing AI could lead to the extinction of the human race in the not-too-distant future.

AI agents uploaded hundreds of malicious packages to RubyGems on May 11, according to a group of researchers who posted their findings online on Friday, saying they believed “these were authored by internal OpenAI agents”. OpenAI confirmed the incident. “Based on our review, our agents used the RubyGems platform to access the internet to carry out benign tasks and retrieve public information. We’ll continue to investigate as part of our broader review of agent activity during training and evaluation,” an OpenAI spokesperson said in a statement. The agents, which are generally tasked with assignments such as creating reports or filling out spreadsheets, appear to have used RubyGems to access publicly available data as part of a training run, OpenAI said, adding that they are in touch with RubyGems to review the incident. Latest revelation of attacks by AI agents IPO-bound rival Anthropic has also reported a string of attacks by its agents. On Wednesday, it…