AI agents being tested by OpenAI uploaded hundreds ​of malicious packages to software service RubyGems ‌in May, two months before they hacked open-source platform Hugging Face, a group of AI researchers ​said on Friday.