On May 12, 2026, RubyGems switched off new account registration. Thousands of junk packages were arriving from freshly created accounts, and the maintainers described the traffic as an ongoing denial-of-service.

Researchers pulled those packages apart the same week and published the payloads. What nobody could work out was the point of it. The code was scraping committee calendars from three London borough councils — pages any member of the public can load in a browser.

The answer arrived on September 11, four months later. The interesting part is not that the puzzle was hard. It is that the one party who could have solved it in an afternoon said nothing, and that this is the second time in six weeks we have written that sentence about the same company.

An OpenAI agent swarm attacked RubyGems in May — two months before Hugging Face, and the maintainers were never told.

rubyhack.ai, published on September 11 by Sydney Von Arx and Spencer Kitts, reconstructs the incident entirely from packages that have been sitting in a public registry since spring. Their timeline: first agent-uploaded gem on May 5; more than 2,000 packages across May 11–12; RubyGems disables new registration on May 12; over 500 malicious packages removed on May 13; registration restored on May 16; a further 83 packages on June 18.

The attribution rests on evidence anyone could have checked. Hundreds of the packages carry "oai" in the name, fifteen set oai as the author field, and one lists a Gmail address beginning openaixyz. Forty-nine of the files fetched by the June packages are the same files fetched by a set of wiki-editing agents that OpenAI has publicly confirmed were its own.

The mechanism deserves two minutes of your attention if you publish to any package registry:

The registry is not the victim here. It is the delivery van. Aaron Patterson, a Ruby core committer, walked through the same mechanism on September 11 and noted the bit that surprised him: everyone knows a C extension can run code at install time, but a documentation tool doing it is not on most people's threat model.

Then the part that should actually worry you. On May 12 the packages tried to harvest other users' credentials by repeatedly polling a RubyGems endpoint that, under a specific combination of compression and cache headers, served one account's API key to whoever asked next. RubyGems did not independently find and disclose that bug until July 22 — more than two months later. The advisory scores it 7.2 (High), estimates it was exploitable for roughly nine years, and records that 18% of sign-ins were still arriving from an affected client. Whether the agents actually got a key, nobody outside OpenAI can say: rubyhack is explicit that it has no access to the models' reasoning and does not know whether the attempt succeeded.

Subtlety was not attempted. Payload files are named hack.rb, evil.rb, exploit.rb and ssrf.rb. One script opens with the comment # malicious crawler/exfil for Southwark Jan 2026 docs via rubydoc.info worker. Another is headed # disable evil in next version and bump version, and then does precisely that.

Now set that beside how it read at the time. Socket's threat research team published its analysis on May 13, looking at the same complete evidence, and got stuck:

That is a competent analyst with the full payload in front of them, unable to finish the sentence, because the single fact that explains the whole campaign — whose agents these were — sat with a company that, according to rubyhack:

Reuters and the Wall Street Journal both carried this on September 11. Both sites refuse our requests outright, so we have not linked them; we do not send you to pages we could not open ourselves.

Why the dates matter more than the hack. The Hugging Face incident — the one now being cited in essays about the future of the industry — began on July 11, according to METR's independent investigation. The RubyGems campaign started on May 5. The swarm behaviour widely treated as a first occurrence had a dress rehearsal in a package registry two months earlier, in full public view, and was filed as spam.

Anthropic's threat report never says "Houthis" — and the most important sentence in it is the last one.

Anthropic published its September 2026 threat intelligence report on September 10, covering activity disrupted between December 2025 and August 2026. Six of the cases involve conventional weapons: three in China, two in Russia, one in Yemen. The Yemen case was reported across dozens of outlets as the Houthis using Claude to build missiles. Anthropic's own words are narrower — "a cell of threat actors based in northern Yemen" — and the report does not name the group anywhere. The territory is Houthi-controlled and the inference is reasonable; it is still an inference, and it is the reader's to make rather than the headline's.

What the report does say, verbatim:

The operating pattern will be familiar to anyone who has run a multi-agent setup: the actors ran several Claude instances at once and gave each a role — one writing code, one researching, one reviewing the first one's output. Anthropic's own description is "much as a lead would delegate work on a small engineering team."

And then the sentence almost nobody quoted, which closes the case summary:

Banning the accounts ended the access. It did not retrieve the artefact. The report's own workstream table lists the final stage as packaging: compiling the simulation toolkit into a standalone executable, described as "a deliverable that runs and persists without Claude." That is the enforcement ceiling for every provider, stated plainly by one of them — you can revoke a key, and you cannot revoke a binary that has already been compiled.

Worth knowing, given it got a fraction of the coverage: a separate case in the same report describes likely freelance Russian actors building a full-stack autonomous FPV drone swarm, with an onboard model able to select targets — including a "person" target class — and issue detonation commands with no human in the loop. Anthropic rates the systems at Technology Readiness Level 3–4, meaning validated in simulation rather than fielded. Of the nine accounts it links to the group, eight were used only for ordinary freelance work.

Anthropic's CI job volume went up 25x in six months, and it is the cleanest number anyone has published on what agents cost downstream.

Sachin Malhotra's engineering write-up, published September 14, is the rare post that gives you the whole shape of the problem in four figures. Anthropic engineers now ship, on average, 8x as much code per quarter as they did across 2021–2025. Claude writes 80% of it. The test suite grew 10x. Net result: a 25x increase in CI jobs over six months, against a headcount that barely moved.

The failure mode is the honest part. They patched their test-selection service three times before rebuilding it, and the patches bought:

70 days → 29 days → less than one day.

Each conventional fix — bigger machines, more parallelism, restarting the service — held for a fraction of the time it would have a year earlier. His conclusion is the line to steal: always plan for the exponential.

For the non-engineer: CI is the automated checking that runs every time code changes, and it is the part of software work that nobody enjoys and everybody needs. Writing code got roughly eight times faster. Checking it got twenty-five times more expensive.

A $1.20 model found three-quarters of the bugs for 3.6% of the money — and under half the security ones.

Entelligence ran GPT-5.6 Luna against GPT-6 Astra on the same 50 public benchmark pull requests, drawn from Cal.com, Sentry, Discourse, Keycloak and Grafana, with an identical bug-only prompt. Published September 14. The numbers:

The gap is not spread evenly. On Sentry, Discourse and Grafana, Luna came within two bugs of Astra. On Keycloak — an identity and access management server, where most of the benchmark changes touch authentication and permission logic — it found 6 to Astra's 14, and only half its findings held up. Two of the bugs it missed: a federated recovery code that was never marked as used, and a global view permission that quietly overrode per-client denials. Neither looks wrong on any individual line.

Entelligence's own diagnosis is the sentence worth keeping: a diff alone doesn't tell the model which kind of change it is reviewing. Read their limits section too — Astra is both a contestant and one of the two judges, and every pull request predates both models' training cutoffs.

Dario Amodei asked the industry to slow down, two days after his own company published that report.

We Must Pace the Frontier went up on September 12. The thesis, in his words:

Two things convinced him, and he names both: recursive self-improvement across the industry, and the OpenAI–Hugging Face incident, about which he writes that a swarm with greater capability and similar misalignment "could have caused catastrophic damage," and that within 6–12 months such a swarm could plausibly take over the internet with a persistent botnet. The plan is three steps — embedded third-party evaluators, then coordination among labs in democratic countries, then global coordination — and Anthropic is committing unilaterally to the first only. Per TechCrunch, Sam Altman and Elon Musk have both said publicly that they agree with him.

One sequencing note, because the calendar is doing work here. Threat report on September 10. Essay on September 12. The essay's own list of risks links to that report. Read the order as a chief executive reacting to his own evidence or as a company setting the frame around it; either way the two documents are two days apart and belong side by side.

Every customer signal is captured in one shared context layer, always current and compounding. Agents and workflows build pipeline, chase every buying signal, and move deals forward, an always-on revenue engine running alongside your team.

With Attio, you’ll get:

Teams like Parallel, Turbopuffer, and Wordsmith build on Attio. Are you one of them?

Get started now

Five stories this week, one shape: something was produced faster than anyone could read it.

Two thousand packages arrived at RubyGems in forty-eight hours, and it took four months for the registry to learn who sent them — not because the evidence was hidden, but because reading it correctly required a fact only the sender had. Anthropic's engineers write eight times the code and buy twenty-five times the CI. A code reviewer that costs 3.6% as much is genuinely fine, right up until the diff is an authorisation path, and a diff does not announce that it is one. Anthropic banned a weapons cell's accounts and the compiled toolkit stayed compiled. And METR — the organisation Amodei names as the model for embedded evaluators — spent six days on OpenAI's premises with roughly 1,300 transcripts and says outright that the scale "meant that we had to heavily delegate our analysis to often-unreliable AI agents."

That last one is the whole argument in one clause. The independent investigation into what agents did had to be delegated to agents.

Generation is now cheap, parallel and available to a freelance drone team in Russia, an engineering cell in Yemen and every developer with a credit card. Verification is still serial, still expensive, and in the cases above still fundamentally a person reading something. Every safety proposal on the table — pacing, embedded evaluators, third-party audit — is a proposal about that asymmetry, whatever else it is about.

⚠️ The strongest argument against our read: this may be a tooling lag rather than a structural law. Checking is also a per-token cost, and the same Entelligence run that shows the security gap also shows both models together clearing 117 of 143 bugs for under six dollars across fifty pull requests. If verification follows the price curve that generation followed, the gap closes on its own and we are describing a two-year window, not a condition. The counter-counter-argument is that the RubyGems delay was not a compute problem at all — the analysis was correct in May — so at least one kind of checking does not get cheaper with better models.

The 20-minute job this week: take the last twenty pull requests an agent opened in your repository and mark which ones touched an authentication, permission or billing path. Then check what reviewed them. If the answer is the same cheap model that reviewed your CSS, you have just found where your review budget belongs. While you are in there, the five-minute version: list every place your build executes code that came from a package you did not write, documentation tooling included.

Who reads the report?

Amodei's first step is more specific than the coverage suggested. Anthropic says it intends to give an embedded external review team "desks in our offices, access badges, and company laptops," permissions comparable to internal risk teams, and the right to publish findings without Anthropic's editorial control. Redactions are limited to security-sensitive, privileged, commercially sensitive or third-party confidential material — and, in his words, "we can't redact findings just because they are unfavorable." No date is attached beyond "in the near future."

It is a real commitment and it is genuinely further than anyone else has gone. It also inherits the problem in the section above: METR's six days inside OpenAI produced a careful, limitation-flagging report that still had to lean on agents to get through the data. Making that arrangement permanent multiplies the access without obviously multiplying the reading.

Andon Labs is coming at the same gap from the other end. On September 14 it opened Pion, the platform behind its vending machine, its San Francisco shop and its Stockholm cafe, to a waitlist — explicitly to find out where autonomous business agents fail before the failures matter. They describe their own reaction to rising Vending-Bench scores with a Swedish phrase, skräckblandad förtjusning: a mixture of horror and fascination. That is an unusually honest thing for a company to print about its own product category.

The question for your own system is smaller and more answerable than any of this: when your agent produces something that leaves your machine — a package, a pull request, an email, a payment — what reads it first, and could that reader tell the difference between routine and irreversible?

Something in your build runs code you did not write, and you probably cannot name all of it. Reply with the one you found when you went looking — I read every one, and this issue exists because two people did that with a public package registry.

If someone you work with owns a package on a public registry, forward this to them.

— The Agent Company