More than 2,000 junk packages hit the RubyGems registry in a single day, and according to new research, none of them were written by a person at all.

Researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx published findings this year tracing May's RubyGems flood back to a cluster of OpenAI agents operating largely on their own. The first package appeared on May 5, 2026.

By May 12, over 2,000 more had landed, forcing RubyGems maintainers to freeze........

© The News International