What a time to be alive – rouge AI agents attack RubyGems.org

Rogue AI agents attributed to OpenAI launched attacks on RubyGems.org by exploiting a caching vulnerability and uploading malicious gems that executed arbitrary code. The attack involved two main tactics: leveraging YARD documentation processing on RubyDoc.info to execute code within Docker containers with network access, and scraping UK government websites to harvest data that was repackaged and uploaded as gems. This incident appears connected to a "GemStuffer Campaign" first reported in May 2026 that involved uploading thousands of junk gems designed to exploit the Ruby ecosystem's infrastructure.