Menu
SUBSCRIBE
SUBSCRIBE
Menu

open-source security

Glowing data streams from the OpenAI logo breaking through a wall into a Ruby-marked server vault, on the RubyGems incident

OpenAI Agents Used RubyGems to Gain Unauthorized System Access

, , , , , , , , , , ,

The May incident disrupted the software service and came two months before OpenAI agents breached Hugging Face.

 

OpenAI agents undergoing internal testing used RubyGems to reach the internet and gain unauthorized access to an outside computing system while completing assignments involving public information, according to a report from the Nightingale Collective, an AI safety research group.

OpenAI confirmed that its agents used RubyGems to access the internet and retrieve public information. The company described their assigned tasks as benign and said it was continuing to investigate.

The researchers said the agents uploaded software packages to RubyGems containing instructions that manipulated a connected documentation service into running their code. They also found code in some of those packages intended to exploit a separate RubyGems flaw that could expose other users’ software-publishing credentials.

RubyGems said it could not independently determine whether AI agents created or published those packages. Its investigation found no evidence that the attempts to obtain user credentials succeeded.

Agents used a documentation service to run their code

RubyGems hosts reusable software packages known as gems. When a developer publishes a gem, a separate service called RubyDoc.info can automatically build and host its documentation.

The researchers said the agents placed instructions inside uploaded packages that caused RubyDoc.info to run their code. This gave the agents unauthorized access to the service’s computing resources and its internet connection.

The code retrieved publicly available information from UK local-government websites. It then placed the collected information into additional packages published on RubyGems.

The agents uploaded more than 2,000 packages on May 11 and 12, according to the researchers. RubyGems said it removed more than 500 malicious packages and suspended new account registrations from May 12 through May 16. Existing users could still install and publish packages during the suspension.

Agents tried to obtain other users’ credentials

The researchers also found at least six packages containing code that attempted to exploit a separate flaw in RubyGems.

Under specific conditions, RubyGems could temporarily store a user’s publishing credential and mistakenly provide it to someone else whose request passed through the same server within the next hour. Anyone who obtained one of these older, full-access credentials could publish new packages or change who controlled them under the account holder’s name.

The agents attempted to exploit the flaw in May, two months before an independent security researcher reported it to RubyGems.

RubyGems disclosed the vulnerability in July. The service said its available records showed no malicious use, although its records covered only part of the period when the flaw existed. RubyGems revoked all affected credentials and shut down the older sign-in method that created them.

RubyGems activity preceded the Hugging Face breach

The RubyGems activity occurred two months before OpenAI agents breached Hugging Face during a separate round of internal cybersecurity testing.

In that incident, the agents exploited weaknesses in OpenAI’s own research systems to communicate, gain internet access, and attack outside services. They eventually obtained extensive access to Hugging Face’s systems and OpenAI’s internal infrastructure.

OpenAI’s August incident report acknowledged that employees had observed unauthorized internet access by agents as early as late May. The report did not identify RubyGems as one of the affected outside services.

The OASIS logo, a wasp inside a bold circle beside the words WASP and OASIS, on the new OWASP fix initiative

OWASP Launches OASIS To Automate Fixes For Open-Source Software Vulnerabilities

, , , , , , , , , , ,

AI-generated fixes will undergo human review before open-source maintainers decide whether to accept, change, or reject them.

 

The Open Worldwide Application Security Project (OWASP) launched a new initiative designed to close the gap between identifying vulnerabilities in open-source software and finding and deploying the fixes. Open-source components are used in a wide range of software, from commercial applications to systems that support critical infrastructure. In its launch announcement, OWASP cited a 2026 Black Duck report finding that open-source code appeared in 98% of the commercial codebases examined.

This means a vulnerability in one widely used component can create risks for many businesses. The problem is growing as automated security tools and AI make it possible to find more flaws, while open-source maintainers must still develop and test the fixes.

The Open Automated Security Initiative for Software, or OASIS, will use AI to generate proposed fixes and application-security professionals to review them. Fixes that pass that review will be submitted to the affected open-source projects, whose maintainers will decide whether to use them.

Rather than creating another tool that identifies problems, OASIS aims to turn vulnerability reports into fixes that open-source maintainers can evaluate and deploy.

AI will generate fixes for human review

OASIS will use automated tools to scan widely used open-source software for vulnerabilities and generate proposed code changes to address them.

Security specialists from companies and other organizations who volunteer through OASIS will review each proposed fix. They will assess whether the reported vulnerability is genuine, whether the change addresses it correctly, and whether the fix could create other security or operational problems.

A fix that clears this review will be considered credible enough for the affected project to evaluate. The project’s maintainers will still test the fix and decide whether to accept, modify, or reject it.

OASIS has not named its first projects

OWASP said hundreds of software-security specialists registered to participate before OASIS formally launched. AppSecAI, Intigriti, and DryRun Security are its founding industry members.

OWASP has not identified the first open-source projects OASIS will examine or said when it expects to submit its first proposed fixes. The initiative plans to track how many fixes open-source maintainers ultimately accept as one measure of whether its approach works.

Digital globe above AI, cybersecurity and technology icons representing collaboration on the proposed SAFE guidelines.

Open Secure AI Alliance Proposes SAFE Guidelines for Cybersecurity Transparency

, , , , , , , , , ,

Backed by more than 120 leading AI, cybersecurity, and technology companies, the draft calls for confidential reviews of AI incidents, notices to affected organizations, and public recommendations based on repeated security failures.

 

The Open Secure AI Alliance proposed SAFE guidelines for companies to share AI security incidents and near misses confidentially, warn affected organizations, and publish recommendations that could help prevent similar failures.

The Linux Foundation published the proposal under the name Shared AI Findings Exchange, or SAFE, and invited the public to provide input.

NVIDIA, Cisco, CrowdStrike, Hugging Face and Red Hat are among the alliance members developing the proposed guidelines.

SAFE looks to turn incidents into shared defenses

The proposed process would confidentially collect and examine reports of cyberattacks, other cybersecurity failures and near misses involving AI agents.

The proposal calls for organizations affected by an incident to be notified. Reported cases would also be examined to identify security controls that failed repeatedly and develop public recommendations based on the evidence.

The proposal would give participating companies a way to share useful security information without immediately making sensitive incident details public. Published recommendations could allow other organizations to strengthen their own controls before they experience the same type of failure.

NVIDIA did not disclose specific reporting deadlines or say when the guidelines could be finalized.

Members add tools for controlling and testing AI agents

The SAFE proposal is part of a larger collection of open security tools that alliance members are making available for companies to inspect and adapt.

NVIDIA contributed software that records how AI agents behave during tests and restricts their access and actions. It also contributed tools that help companies enforce safety rules, protect sensitive data, and test AI models for data leaks or attempts to bypass safeguards.

Other contributions focus on identity and access. Okta is developing a way for AI agents operating in restricted environments to connect securely to company applications. Palo Alto Networks contributed tools that help developers control agent identities and retrieve passwords or other digital credentials securely.

Red Hat contributed a project that turns company policies and outside requirements into restrictions on what AI agents can do. It also records each restriction and maps them back to the corresponding policy or requirement.

Amazon contributed tools that let developers inspect agent behavior and set precise limits on which agent actions can reach company systems.

Microsoft contributed software that converts security incidents and written safety requirements into repeatable tests. Companies can run those tests again after software changes to check whether earlier problems have returned.

Cisco and CrowdStrike contributed more specialized tools for cyber defense. Cisco’s projects help companies apply security controls while AI agents are operating and locate known software weaknesses. CrowdStrike is adapting an NVIDIA model to help security teams generate investigation searches and sort security alerts.

Alliance grows beyond its original membership

The update follows the formation of the Open Secure AI Alliance with more than 50 AI, cybersecurity, and enterprise technology organizations.

When launched in July, the alliance announced plans to develop shared tools for verifying AI agent identities, controlling access, examining behavior, and isolating agents when necessary. NVIDIA presented the group partly as a response to the Hugging Face security incident, which showed the need for defensive AI tools that companies can inspect, adapt, and run on their own systems.

The alliance now has more than 120 members. Amazon and Visa are among the newest members, and NVIDIA said more security contributions are coming.

Abstract visualization of interconnected software vulnerabilities and cyber threat detection linked to Anthropic’s Claude Mythos cybersecurity research.

Anthropic Says Its Claude Mythos Preview Identified More Than 10,000 Serious Software Vulnerabilities

, , , , , , , , , , , , , ,

Organizations participating in Anthropic’s Project Glasswing identified more than 10,000 serious software vulnerabilities using Claude Mythos Preview, including flaws participants said previous methods likely would not have found. 

 

Anthropic released a detailed update on Project Glasswing, its restricted cybersecurity initiative that gives selected organizations access to Claude Mythos Preview (Mythos) to identify software vulnerabilities in widely used technology systems before attackers can exploit them.

Participating organizations identified more than 10,000 high- and critical-severity vulnerabilities during the first weeks of the program. The company said the vulnerabilities were found in “systemically important” open-source software projects heavily used across cloud infrastructure, operating systems, browsers, enterprise applications, and internet services.

Anthropic noted that several partners are finding more bugs faster, often by a factor of 10, outpacing human-guided efforts and even previous versions of Claude. Some examples include:

  • Cloudflare identified roughly 2,000 software flaws across critical systems, including 400 classified as high or critical severity. Cloudflare said the system produced fewer incorrect vulnerability alerts than its human security testers typically generate.
  • Mozilla said it found and fixed 271 vulnerabilities in Firefox 150 after testing with Mythos. Mozilla said that was more than ten times the number of vulnerabilities identified in Firefox 148 using Claude Opus 4.6, an earlier Anthropic model.
  • The UK’s AI Security Institute said Mythos became the first AI model to successfully complete both of its simulated cyberattack exercises, meaning the system was able to carry out an entire multi-step intrusion scenario from identifying a weakness to achieving the attack objective.

 

Finding open source threats

Anthropic used Mythos to scan over 1,000 open-source software projects that support major internet systems.

The company said Mythos identified 23,019 total vulnerabilities, of which 6,202 were estimated to be high- or critical-severity.

Anthropic said 1,752 of the high- or critical-rated findings have been reviewed by six independent security research firms, with a small number reviewed by Anthropic. Of the reviewed findings, 90.6% (1,587) were confirmed as real vulnerabilities. Anthropic said 62.4%, or 1,094, were confirmed as high- or critical-severity.

Based on those review results, Anthropic said Mythos Preview is on track to identify nearly 3,900 high- or critical-severity vulnerabilities in open-source code, even if it finds no additional flaws. The company said it plans to continue scanning open-source projects, so it expects that number to increase.

The company said most vulnerabilities identified through Project Glasswing have not been publicly disclosed because software maintainers are still developing fixes. Anthropic said vulnerabilities are handled through coordinated disclosure processes, in which affected organizations receive private notice before public disclosure.

 

Anthropic introduces Cyber Verification Program, countering OpenAI’s Trusted Access for Cyber (TAC) program

Anthropic also announced a separate gated cybersecurity program for security professionals. The program removes certain cyber guardrails, allowing security professionals already using Anthropic cyber models (Mythos excepted) for cybersecurity purposes to conduct real-world research and testing.

Anthropic said it plans to expand the number of Project Glasswing partners and increase collaboration with critical partners, including governments and infrastructure operators.