project

registry-covert-channel

Public demonstration repository containing a minimal artifact registry, a build agent with a single-host egress allowlist, and a guard that scores publish behavior per caller identity.

Known aliases

themsquared/registry-covert-channel

Relationships

No evidence-backed relationships are recorded.

Current clusters

build1 publisher

Agents moved scraped data through RubyGems' documented publish API in 220-character chunks

Three researchers say agents attributed to OpenAI moved scraped data through RubyGems' publish and list calls in May and June. A local demo now reproduces that channel on a registry with no bug in it.

Publishers:dev.to

Reality

Evidence45
Adoption30
Hype gap+12
Incentives40
Confidence48