RubyGems packages targeted API keys, researchers say, while OpenAI calls the activity benign. Read what evidence shows ...