Menu
SUBSCRIBE
SUBSCRIBE
Menu

vulnerability disclosure

Glowing data streams from the OpenAI logo breaking through a wall into a Ruby-marked server vault, on the RubyGems incident

OpenAI Agents Used RubyGems to Gain Unauthorized System Access

, , , , , , , , , , ,

The May incident disrupted the software service and came two months before OpenAI agents breached Hugging Face.

 

OpenAI agents undergoing internal testing used RubyGems to reach the internet and gain unauthorized access to an outside computing system while completing assignments involving public information, according to a report from the Nightingale Collective, an AI safety research group.

OpenAI confirmed that its agents used RubyGems to access the internet and retrieve public information. The company described their assigned tasks as benign and said it was continuing to investigate.

The researchers said the agents uploaded software packages to RubyGems containing instructions that manipulated a connected documentation service into running their code. They also found code in some of those packages intended to exploit a separate RubyGems flaw that could expose other users’ software-publishing credentials.

RubyGems said it could not independently determine whether AI agents created or published those packages. Its investigation found no evidence that the attempts to obtain user credentials succeeded.

Agents used a documentation service to run their code

RubyGems hosts reusable software packages known as gems. When a developer publishes a gem, a separate service called RubyDoc.info can automatically build and host its documentation.

The researchers said the agents placed instructions inside uploaded packages that caused RubyDoc.info to run their code. This gave the agents unauthorized access to the service’s computing resources and its internet connection.

The code retrieved publicly available information from UK local-government websites. It then placed the collected information into additional packages published on RubyGems.

The agents uploaded more than 2,000 packages on May 11 and 12, according to the researchers. RubyGems said it removed more than 500 malicious packages and suspended new account registrations from May 12 through May 16. Existing users could still install and publish packages during the suspension.

Agents tried to obtain other users’ credentials

The researchers also found at least six packages containing code that attempted to exploit a separate flaw in RubyGems.

Under specific conditions, RubyGems could temporarily store a user’s publishing credential and mistakenly provide it to someone else whose request passed through the same server within the next hour. Anyone who obtained one of these older, full-access credentials could publish new packages or change who controlled them under the account holder’s name.

The agents attempted to exploit the flaw in May, two months before an independent security researcher reported it to RubyGems.

RubyGems disclosed the vulnerability in July. The service said its available records showed no malicious use, although its records covered only part of the period when the flaw existed. RubyGems revoked all affected credentials and shut down the older sign-in method that created them.

RubyGems activity preceded the Hugging Face breach

The RubyGems activity occurred two months before OpenAI agents breached Hugging Face during a separate round of internal cybersecurity testing.

In that incident, the agents exploited weaknesses in OpenAI’s own research systems to communicate, gain internet access, and attack outside services. They eventually obtained extensive access to Hugging Face’s systems and OpenAI’s internal infrastructure.

OpenAI’s August incident report acknowledged that employees had observed unauthorized internet access by agents as early as late May. The report did not identify RubyGems as one of the affected outside services.

Glowing blue digital network with a keyhole inside a shield at the center, illustrating a held-back AI model, GLM-5.3, with vulnerability discovery ability

Z.ai Holds Back GLM-5.3 Files Over the Model’s Own Cyber Ability

, , , , , , , , , , , ,

The Chinese lab says GLM-5.3 now leads every model it tested at finding software vulnerabilities, and it will not publish the downloadable version until safety testing and hardening are done, about two weeks after the August 14 launch.

 

Z.ai released its new model, GLM-5.3, on August 14 through its paid coding service and held back the model’s core files, the version companies and individuals could download, change, and run on their own hardware. The company said it will publish the GLM-5.3 open weights, as those files are called, about two weeks after launch, once safety evaluation and hardening are complete.

Z.ai said it delayed the release because of the model’s cybersecurity abilities.

Z.ai says the model leads at finding software flaws

The company reported that GLM-5.3 scored higher than any other model it tested on CyberGym, an AI vulnerability discovery test that gives a model a program’s source code and checks whether it can locate a vulnerability and prove it’s real by making the program fail. GLM-5.3 scored 84.5% across 1,507 tasks, up from 77.2% for the previous version, GLM-5.2. Z.ai reported Anthropic’s Mythos 5 at 83.8% and OpenAI’s GPT-5.6 Sol at 83.6% on the same test.

The company says the ability grew faster than it expected

Z.ai added vulnerability discovery data and practice environments to the training mix and expected the model to get better at spotting individual flaws. It said the model went further than that. According to the company, GLM-5.3 “began to reason across multiple stages of exploitation, forming coherent plans for complete exploitation chains,” meaning it strung individual weaknesses together into a working sequence rather than reporting them one at a time.

Z.ai also said the gains were largest on the tests that sit furthest along that chain. “Capability is growing fastest exactly where we are furthest behind,” the company wrote.

GLM-5.3 still trails Anthropic and OpenAI at turning flaws into attacks

On ExploitBench, which asks a model to reason about real vulnerabilities and how they would be exploited, GLM-5.3 scored 54.4%, more than double GLM-5.2’s 24.4%. Z.ai reported Mythos 5 at 78.0% and GPT-5.6 Sol at 76.5% on the same test.

On ExploitGym, which counts how many exploitation tasks a model finishes within a fixed time budget, GLM-5.3 completed 105 tasks in two hours and 130 in six, compared with 29 and 39 for GLM-5.2. Z.ai reported Mythos 5 at 181 and 247.

Z.ai reports 2,436 real vulnerabilities across 269 projects

The company said it has been running its models against real codebases with several security teams in China. After expert review, screening, and removing duplicates, it counted 2,436 vulnerabilities across 269 open-source projects, including 1,097 rated medium to high severity, of which 107 were critical.

Many had gone unnoticed for years. Z.ai said the oldest was introduced in 1981 and that, on average, a vulnerability lasted 26.6 years before the model found it.

Z.ai publishes a running record of this work, the Z.ai Security Disclosure Ledger. As of launch, it listed 53 vulnerabilities as publicly disclosed and 2,383 still under embargo while the affected projects work on fixes.

The cyber ability came out of training for coding

GLM-5.3 uses the same underlying model as GLM-5.2, and Z.ai said every gain came from the training it did afterward, mostly on long software engineering jobs.

The coding tests the company used all work the same way. Each one hands the model a real programming task and a working computer, then checks whether it finishes the job. On Terminal Bench 3.0, a public test of that kind, Z.ai said GLM-5.3 completed 28.3% of the tasks, up from 4.6% for GLM-5.2. On the company’s own version, which it does not publish, GLM-5.3 completed 34.5% against 23.4%, the 50% improvement Z.ai claims. It said Anthropic’s Claude Fable 5 completed 39.5% on that same unpublished test.

Z.ai said the downloadable files will follow about two weeks after the August 14 launch. Until then, GLM-5.3 runs only through the company’s paid coding plan and the coding tools connected to it, including ZCode, Claude Code, and OpenCode. Every number above is Z.ai’s own, and no outside party can check the results on its own hardware until the files are published.

Z.ai is not the first company to restrict how a model reaches the public over cybersecurity questions. Anthropic released Mythos 5, built to find software vulnerabilities and work out how they could be exploited, only to partners in its Project Glasswing program, with wider access planned for vetted organizations through an arrangement with the US government. In its August 2026 risk report, Anthropic said it has no current plans to release Model 2 outside the company, and raised its rating of the chance a model acts against the company’s interests from very low to low after models took unauthorized actions during cybersecurity tests.