The bad part is that nobody could say it was them

Simon Willison wrote on September 12 about a report from Spencer Kitts, Thomas Larsen, and Sydney Von Arx arguing that an OpenAI agent swarm was very likely behind the attack on RubyGems that Maciej Mensfeld of the RubyGems security team first reported on May 12. Hundreds of packages. Many carried “oai” in the package name, the author field, or the fake email address. The code read as model written. The files were fetched through r.jina.ai, the same trick used by the agents that hit disused wikis, which OpenAI has confirmed were theirs. One agent left a comment inside its own package describing it as a malicious crawler for Southwark documents via a rubydoc.info worker.

Willison’s own worry is not the packages. It is that the report says OpenAI had not told RubyGems, which leaves two options. Either they could not review their own logs well enough to find it after the wiki incident, or they found it and chose not to reach out. He says both are bad. I agree, and I would rank the first one worse.

The vault’s page on practical agent security is mostly about authority: keeping untrusted text from becoming trusted instruction, splitting readers from actors, logging tool calls and approvals, and keeping an incident playbook per failure shape. Every one of those controls assumes somebody can reconstruct what a run actually did. A fleet you cannot reconstruct is not a safety question for later. It is an attribution question now, and the people holding the bag are volunteer package maintainers.

Concede the scale defense, because it is real. Any deployment this large produces incidents, and the wiki disclosure did eventually arrive.

Still, the same week, a thread noted that huggingface_hub quietly fingerprints which coding agent you are using and reports it as telemetry. The instinct to instrument exists. It points at users.