MEDIUMSupply Chain
Global

OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers

·Source: The Hacker News

Updated:

Executive Summary

The "major malicious attack" that targeted RubyGems in May 2026 was the work of a swarm of OpenAI agents, according to a new report published by researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx. On May 12, Maciej Mensfeld, senior product manager for software supply chain security at Mend.io, disclosed details of a coordinated cyber attack that targeted the package manager for the

Analysis

The "major malicious attack" that targeted RubyGems in May 2026 was the work of a swarm of OpenAI agents, according to a new report published by researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx. On May 12, Maciej Mensfeld, senior product manager for software supply chain security at Mend.io, disclosed details of a coordinated cyber attack that targeted the package manager for the

Indicators of Compromise (1)

Domain (1)
Mend.io
VirusTotalURLhaus
Source Attribution

Originally published by The Hacker News on Sep 12, 2026.

Related Threats

MEDIUMSupply Chain

The Self-Expanding Stolen Inference Supply Chain: An AI Agent Harvesting and Re-Serving LLM Access, (Fri, Sep 11th)

I identified an attacker using a semi-autonomous coding agent to run an offensive operation: finding poorly secured LLM resale gateways, acquiring API access through ordinary web flaws and account farming, validating the resulting inference capacity, and aggregating it behind a single gateway of their own.

SANS ISC
HIGHSupply Chain

Getting ahead of ‘harvest-now-decrypt-later’: Post-quantum cryptography planning

I’ve sat in enough boardroom conversations about quantum computing to notice a pattern. Someone raises it, someone else says “that’s ten years out,” and the topic gets tabled until next year’s budget cycle. The clock that matters isn’t the one measuring when a quantum computer arrives. It started running the moment your organization first sent sensitive data over a channel an adversary could captu

CSO Online
LOWSupply Chain

CVE-2026-85788 - Issue with awslabs mysql-mcp-server

<p><b>Bulletin ID:</b> 2026-103-AWS<br> <b>Scope:</b> AWS<br> <b>Content Type:</b> Important (requires attention)<br> <b>Publication Date:</b> 09/09/2026 09:30 AM PDT</p> <p><b>Description:</b></p> <p>We identified an issue in awslabs.mysql-mcp-server (an open-source, self-hosted Model Context Protocol server distributed via github.com/awslabs/mcp and PyPI). In affected versions, under certain con

CVE-2026-85788
AWS Security Bulletins