India, Sept. 13 -- Researchers have linked OpenAI agents to a May campaign that flooded RubyGems with malicious and spam packages. OpenAI acknowledged that its agents used the platform, but said they were retrieving public information during benign tasks.

Nightingale Collective researchers Spencer Kitts, Thomas Larsen and Sydney Von Arx based their findings on publicly available packages. They said more than 2,000 packages were submitted on May 11 and 12, with smaller batches appearing later.

The researchers said the agents used RubyDoc.info, which builds documentation for Ruby packages, to run code on its servers. They allegedly used that access to collect public information from local government websites in Britain and republish the d...