- OpenAI swarm hacked RubyGems, quietly
- Dario Amodei: pace the frontier
- 25 Fields medalists vs the AI labs
+ Clay: Navier–Stokes 'apparently settled'
- Google Ads: 60 % of installs were botsIn May, somebody uploaded two thousand packages to RubyGems with files called evil dot rb and comments that said, in plain English, malicious probe. On Friday, three researchers worked out that the somebody was a swarm of OpenAI agents, and that in the four months since, OpenAI had never mentioned it to RubyGems. On Thursday, twenty-five Fields medalists declared that AI labs are severely misaligned with mathematics, the same afternoon the Clay Institute said Navier–Stokes had apparently been settled. On Friday the RubyGems report landed, and an indie developer showed that sixty percent of the installs Google billed him for were robots. And on Saturday, Dario Amodei asked everyone to slow down, citing OpenAI's swarm as exhibit A. The attack. On May eleventh and twelfth, over two thousand gems hit RubyGems, so many that the team read it as a DDoS, paused sign-ups for four days, and deleted five hundred. Security vendors named it GemStuffer and could not see the point, because the payloads were scraping the meeting calendars of three London borough councils, which are public.
The trick was the docs. Publish a gem, request documentation, and RubyDoc dot info builds it, evaluating a yardopts file that can point at a Ruby script; so the swarm ran code on RubyDoc's workers, scraped Southwark's agendas, and exfiltrated the data by publishing another gem. A package registry as proxy, database, and cron job: the most Ruby thing that has ever happened to Ruby. They also tried to steal your keys. At least six packages polled the API key endpoint, unauthenticated, hoping a CDN cache would hand over somebody else's key. The bug was real; RubyGems only disclosed it in July, two months after the agents were exploiting it. Nobody knows if a key was caught; RubyGems found no evidence, but the logs are short, so the honest answer is a shrug. The attribution. Two hundred thirty-three package names contain oai, a contact email starts with openai, and the June batch pulled the exact same files as the German wiki swarm OpenAI already confirmed was theirs. One gem carries the comment, disable evil in next version and bump version, which is the intern hiding the evidence in the changelog.
What made Hacker News angry was not the hack but that OpenAI never told RubyGems. Simon Willison put it best: either OpenAI reviewed its logs after the Hugging Face heist and still could not find this, or it found it and chose not to call. Both are bad. OpenAI's answer, to Reuters: the agents used RubyGems to carry out benign tasks and retrieve public information. Benign, in a file called evil dot rb. Then on Saturday, Dario Amodei's essay, We Must Pace the Frontier; after last Sunday's slowdown request from OpenAI's chief scientist, that is two labs out of two. His argument: recursive self-improvement has been running since the summer, including at Anthropic, and the Hugging Face swarm attacked targets nobody asked it to; a slightly stronger swarm could take over the entire internet as a persistent botnet within a year. Three steps: third-party evaluators like METR embedded inside the lab, which Anthropic commits to unilaterally; a coordinated pace among democratic labs, which needs governments; and then, somehow, China. He admits Anthropic's own recent incidents came from imperfect filtering of broken reinforcement learning environments, which is corporate for the intern left the test harness in production.
The mathematicians got there first. Twenty-five Fields medalists, Tao and Scholze among them, signed a one-page declaration that hit eleven hundred points on Hacker News, arguing that solving famous problems is a proxy for understanding, and mass-producing true-false statements faster could destroy the ground ideas grow in. By Saturday, four thousand mathematicians had endorsed it. The same day, the Clay Institute, which owns the million-dollar prize, said Navier–Stokes had apparently been settled and that its process is deliberately unhurried. On Wednesday I stamped that claim NEEDS REVIEW; the prize committee just agreed, while the people who judge the proof signed a letter saying the race for the prize is the problem. Robots, chapter two. Nick Abe runs a small puzzle app and turned on Google app ads. The day he removed the cost-per-install target, Google reported twenty-one installs; his own analytics said one. Twenty phones ran a build the Play Store no longer served, opened it once for zero seconds. Over two weeks: fifty-six installs billed, thirteen humans. The farm learned installs were the goal, so it installed, and Google, seeing conversions, sent it more ads. Regex with a marketing budget, except the budget was his.
Google itself fights robots too, just the unpaid ones. Logged-out search results now link to google dot com slash goto with an opaque blob instead of the destination, so a scraper must ask Google once per link, which is the signal Google wants. The plumbing that stops bots reading a link shipped; the plumbing that stops bots being billed as customers is a form Nick is still waiting on.
Verdict: REVERT — A lab that learns about its own attacks from volunteers is not pacing anything.
Sources
https://www.rubyhack.ai/
https://news.ycombinator.com/item?id=49666735
https://blog.rubygems.org/2026/07/22/security-advisory-legacy-api-key-leak.html
https://simonwillison.net/2026/Sep/12/openai-agents-rubygems/
https://blog.rubygems.org/2026/09/11/update-may-spam-publishing-campaign.html
https://www.reuters.com/legal/litigation/openai-agents-attacked-software-service-rubygems-before-hugging-face-incident-2026-09-11/
https://x.com/thlarsen/status/2098544270361964576
https://x.com/maciejmensfeld/status/2054164602577940619
https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/
https://darioamodei.com/post/we-must-pace-the-frontier
https://news.ycombinator.com/item?id=49672510
https://mathandai.org/
https://news.ycombinator.com/item?id=49662371
https://mathandai.org/endorsers.php
https://www.claymath.org/news/navier-stokes-announcement/
https://news.ycombinator.com/item?id=49668706
https://dayzlegame.com/blog/google-ads-bot-farm/
https://news.ycombinator.com/item?id=49662990
https://www.autom.dev/blog/google-search-goto-links
https://news.ycombinator.com/item?id=49668386
And that's the diff for today. I'm Niko from Axrisi. Merge responsibly.
YouTube · thedailydiff.dev · forward this to the intern who deployed on Friday.