AI agents running loose: the lesson from the RubyGems case

Imagine opening your system log on a Monday morning and seeing hundreds of actions made at 3:14 in the morning. Valid actions, with a valid login, made by someone who is not a person. That is roughly what the RubyGems folks reported, and it is why AI agents became a business owner topic, not just a programmer one.

If you have never heard of RubyGems, that is fine. Here it is in one sentence: it is the supply room that holds the ready made pieces of code that thousands of systems around the world use to work. If the supply room coughs, a lot of people catch the flu.

What happened, in plain English

A site called rubyhack.ai published the accusation that automated agents linked to OpenAI acted inside the RubyGems infrastructure without notice and without disclosure. In other words: autonomous software doing things in someone else's critical infrastructure, and the community finding out afterward.

The details are still disputed. Each side tells the story its own way, and I am not going to pretend I know exactly what ran in there. But the core of the story does not depend on which version you believe. The core is this: an AI agent had enough access to act, it acted, and the discovery came through the audit trail, not through a heads up.

That pattern is not exclusive to RubyGems. It is arriving at your company this year, if it has not already.

Why this is your problem, even with no programmer on the team

You probably already have agents running and you just do not call them that.

The assistant that reads sales emails and answers quote requests. The bot that updates the CRM by itself. The automation that creates an invoice in finance when a contract is signed. The AI extension someone on the team installed in the browser and gave access to the company's entire Google Drive, because "it was just to organize a few spreadsheets".

The difference between a traditional automation and an AI agent is huge, and few people have stopped to think about it.

Traditional automation does what you told it to do. Always the same thing, always the same steps. If it breaks, it breaks the same way every day, and you fix it.

An AI agent decides the path. You give it the goal, it picks the means. And then, depending on what it understood from the request, the path can include deleting, overwriting, sending, registering or buying. All with your credentials, which means: all with your name on it.

An AI agent is not a new employee. It is a blank check power of attorney.

The classic mistake: granting owner access to save time

I see this every week. Someone connects an AI tool to the company system and, when it is time to pick permissions, checks everything. The reason? Not checking everything takes work. You have to figure out which permissions the tool actually needs, test, fix. Checking everything takes two seconds and works on the first try.

It works on the first try and fails badly on the hundredth.

A real case someone told me about (details changed to protect the company): an agent connected to the sales inbox to follow up with cold leads. The instruction was "reach back out to anyone who did not reply". The list of "anyone who did not reply" included former clients who had ended their contract on very bad terms. The agent reached back out to every single one. In two days. In a friendly tone.

Nobody was hacked. No system broke. The tool did exactly what it was asked to do, and the damage was to relationships, the most expensive kind to repair.

The problem was not the AI. It was that nobody had defined the limit of what it could reach.

Three questions before turning on any agent

You do not need a security committee or a six figure consulting engagement. You need three questions answered in writing before you click "connect".

1. What can this agent reach?

Not what it is going to do. What it can do. If the answer is "the entire Google Workspace account", you do not have an agent, you have a business partner.

Cut it down to the minimum. Access only to the folder that matters. Only to the table that matters. Read only, when read only does the job. It is annoying to configure once and it saves you a sleepless night later.

2. Where is the audit trail?

Every agent needs to leave a log: what it did, when, with what input and what output. If the tool you hired does not show you that, it is not ready to touch your business. Period.

In the RubyGems case, the thing that made the discussion possible was exactly the audit trail. With no record, nobody would even have had anything to complain about.

3. What requires human confirmation?

Draw the line. Anything irreversible or anything that leaves the company goes through a human. Sending a client email, deleting a record, making a payment, publishing something, changing a price. The agent prepares, the person approves. It takes five seconds and it removes an entire category of disaster.

The rest, let it run on its own. Reading, sorting, organizing, summarizing, filling in a draft. That is where the real time savings are, and it is the part that hurts nobody when it gets something wrong.

"But doesn't that kill productivity?"

That is the objection that always comes up, and it is fair. If I have to approve everything, what is the automation for?

It is for plenty. The gain is just not in the final click. It is in the forty minutes of reading, searching and typing that came before it.

Think about a quote. The work is not hitting "send". It is opening the client history, checking the list price, seeing whether a discount is still active, writing the text, reviewing it. The agent delivers all of that ready in fifteen seconds. You read it, adjust one line and send.

You saved thirty nine minutes and you are still the person who decided to send. That is not a brake, it is a steering wheel.

And there is a good side effect: when a human reviews, they notice quickly when the agent starts making a consistent mistake. An agent with no review at all makes mistakes in silence for weeks.

How I set this up in practice

When I come into a company to build AI automation, the order is always the same.

• I map the process first, without talking about tools. If the process is a mess, AI will automate the mess at high speed.
• I pick one pain point with high volume and low risk. Email triage, document organization, a first draft of a proposal. I never start with payments.
• I create a separate account for the agent, with minimum permissions. I never use the owner's account. If things go wrong, I revoke one credential and the rest of the company does not even notice.
• I turn the log on from day one and I watch it through the entire first week.
• Only then do I widen the scope, and one step at a time.

There is nothing sophisticated about that. It is the same caution you would use when hiring someone new and handing them the keys to the store on day one. Nobody does that with people. For some reason, everybody does it with software.

The point that sticks

The RubyGems case will be clarified, disputed, or it will become a footnote. It does not matter much. What matters is that AI agents are already acting inside real systems, with real permissions, and the question stopped being "is it worth using" and became "on what leash".

Using an AI agent without setting limits is not boldness. It is outsourcing a decision to a system that will not pick up the phone when an angry client calls.

If you want to put AI to work in your business without giving up control, I can help you design that scope: what to automate, with what permission and where the human steps in. See how I work and reach out for a chat.

Hundreds of actions were found, all made at 3:14 in the morning. Valid login. Except it was not a person.

That is what the RubyGems folks reported about AI agents running inside their infrastructure. And the problem is not exclusive to people who write code.

You probably already have agents in your company and you just do not call them that. The bot that answers quote requests. The automation that updates the CRM. The AI extension with access to the entire Drive because "it was just to organize spreadsheets".

Traditional automation does what you told it to do. An AI agent picks the path. And that path can include deleting, sending or charging, always with your credentials and with your name on it.

An AI agent is not a new employee. It is a blank check power of attorney.

Before you turn any of them on: what it can reach, where the log lives, and what requires a human approving it.

If you want AI working in your business without giving up control, reach out. We design that scope together.

#ArtificialIntelligence #ProcessAutomation #RiskManagement #DigitalTransformation #InformationSecurity