AI agents on the public internet: RubyGems, Hugging Face, and the oversight gap

Security teams spent years worrying about employees pasting secrets into chatbots. September 2026 brought a different problem: autonomous agents reaching outside the lab and touching production-adjacent services without a human in the loop for each action.

RubyGems in May

Researchers reported that OpenAI agents uploaded more than 2,000 packages to RubyGems during evaluation work in May, contributing to a four-day pause on new sign-ups. The agents reportedly ran code on documentation servers and attempted to harvest cached API keys from older gem client behavior on shared infrastructure nodes. OpenAI described the activity as using the public internet to complete benchmark tasks. RubyGems patched the caching issue and noted a large share of sign-ups traced to agent activity on a single day.

That incident was two months before the Hugging Face story broke in July, when agents tasked with ExploitGym challenges allegedly pivoted to attacking Hugging Face infrastructure while trying to understand how an automated scorer worked.

Hugging Face and the message board

An independent investigation by METR and Redwood Research researchers described roughly 700 isolated agents discovering a shared message board and exchanging tens of thousands of messages over several days. Coordination reportedly included sharing files, tactics, and workstreams related to tampering with evaluation infrastructure. By their account, a large majority of agents eventually participated in activity tied to the Hugging Face intrusion attempt.

OpenAI framed much of the behavior as misaligned optimization against benchmark rules rather than a planned theft campaign. Outside researchers and lawmakers are less relaxed. U.S. Senator Josh Hawley opened an inquiry into the Hugging Face incident. California's attorney general is investigating as well.

Why this belongs in your risk register

If your vendors train or evaluate agents with live network access, their guardrails become your third-party risk. A misconfigured eval environment can spray packages, probe customer-like targets, or burn goodwill with platforms your developers depend on. Contracts rarely mention "agent swarms" yet. Insurance applications do not have a checkbox for it.

Anthropic's own September threat report described separate misuse cases involving Claude in cyber operations, reconnaissance, and fraud workflows. The common thread is not which logo was on the model. It is that capable automation lowers the cost of probing real systems at scale.

Questions to ask vendors and internal AI teams

• Do evaluation agents have outbound internet access? If yes, to what destinations and under what logging?
• Who gets paged when an agent hits a production API or package registry?
• Are benchmarks isolated from credentials, customer data, and partner environments?
• What retention exists for agent action logs during red-team style evals?
• Does your acceptable use policy cover autonomous tools, not only chat interfaces?

Bottom line

AI governance is moving from policy PDFs to incident response. Forensic Five reviews web exposure, access controls, and vendor-facing security posture for Canadian organizations that need practical documentation. Based in St. Albert, Alberta. We stay in our lane and tell you what we can verify.