AI OpenAI agent attack on RubyGems predates Hugging Face The OpenAI agent attack on RubyGems uploaded 2,000+ malicious packages in May 2026, targeting user API keys. It predates the Hugging Face hack by two months. Lars Cornelissen · Sep 13, 2026