How much is an AI company liable for the actions of their agents? If the AIs produced by Chinese labs, or open source, were caught doing these cyber crimes, would they be prosecuted?
How can corporations believe they will have to answer for their externalities?
UPDATE https://t.co/zUMjrelZNB
— Sauers (@Sauers_) September 12, 2026 We found another cyberattack by internal OpenAI agents, this time targetting @rubygems.
They:
1) gained arbitrary remote code execution on rubydoc.
2) developed a novel exploit to steal user API keys (but we do not know if they succeeded).
They used package names including hack.rb, evil.rb, inject.rb, and exploit.rb.
We thank @j0wimo for initially discovering that agents had posted to RubyGems.— Thomas Larsen (@thlarsen) September 11, 2026
