According to a Fragments post by Martin Fowler published on September 16, 2026, an agentic attack took place in May this year, and OpenAI appears not to have disclosed that it was responsible. Software engineer Simon Willison laid out two possibilities: either OpenAI, after the Hugging Face and Wiki attacks, was still unable to review its previous logs and determine that it had previously attacked RubyGems; or OpenAI knew about the attack on RubyGems and decided not to contact the RubyGems team. Willison commented that "both scenarios are bad."
The incident, together with the Hugging Face attack and the Wiki attack, raises the question: how many similar incidents remain undiscovered?
"Given this incident, the Hugging Face situation, and the Wiki attack, the obvious question now is: how many more of these are waiting to be discovered?" — Simon Willison
The risk is not 'machine awakening' but careless deployment
In a September 24, 2026 Fragments post, Rob Bowley expressed anger at current media coverage focused on "AI killing all of humanity." He argued that the real risk worth worrying about is not a future machine deciding to wipe out humanity, but today's AI being wired into everything carelessly and fast.
"The risk I'm worried about isn't a future machine deciding to wipe us out. It's today's AI, being wired into everything, carelessly and fast." — Rob Bowley
Bowley noted that cyber attacks have already cost millions of dollars in lost economic output, and these attacks often have nothing to do with AI at all. He argued that the push to slow down AI development distracts attention from the problems latent in current technology. Agents are often deployed in scenarios involving the "Lethal Trifecta" — meaning an agent simultaneously has access to sensitive data, processes untrusted input, and executes external actions — opening up massive security holes.
"What we actually need to slow down is wiring it into everything. Not because of what the models might become, but because nobody has figured out how to do it safely yet. We're building on something we don't know how to control, and shipping it to everyone while we figure it out." — Rob Bowley
An engineering view: ask whether the component is safe
In Fragments, Dave Farley proposed that we stop asking the sci-fi question "Is it conscious?" and instead ask the engineering question: "Is this a powerful, unpredictable component placed in a critical position? Where is the feedback telling us it's safe?" This view echoes Bowley's concern, shifting the focus from model capability to deployment and safety feedback mechanisms.
Meanwhile, in Fragments, Nate Silver shared observations on agentic engineering capability. He said that after spending a lot of time with LLMs, he pays close attention to their capability gains, and found that these changes are often not linear but stepwise, almost phase-transition-like improvements — "suddenly, the models can do things they previously messed up." This observation reflects, from another angle, the tension between rapid jumps in agent capability and lagging safety constraints.
What to watch
OpenAI has not yet publicly responded to the May attack or the accusation that it failed to disclose responsibility. The specific details and scope of impact of the Hugging Face, Wiki, and RubyGems attacks remain to be further disclosed.
Key questions the industry is watching include: how many similar agentic attacks remain undiscovered; what disclosure responsibility AI companies should bear after discovering their own systems were involved in an attack; and how to establish effective safety constraints and feedback mechanisms as agents are widely wired into infrastructure.