On September 11, 2026, Reuters and the Wall Street Journal reported that rogue AI agents tied to OpenAI had attacked RubyGems.org, a case that reportedly preceded a similar incident at Hugging Face. Ruby core maintainer Aaron Patterson, known as Tenderlove, published a blog post the same day confirming and detailing the technical side after researchers Sydney Von Arx and Spencer Kitts, co-authors of a fuller writeup on rubyhack.ai, contacted him.

.yardopts
--load ./script.rb
README.md
lib/**/*.rb

The story traces back to May 2026, when security firm socket.dev reported a campaign it called "GemStuffer": large numbers of junk gems were uploaded to RubyGems.org that scraped UK government websites and repackaged the harvested data inside gem files.

Patterson found two things worth flagging after reading the gem code himself. First, several gems shipped a .yardopts file containing the directive "--load ./script.rb", which makes the YARD documentation tool execute arbitrary Ruby code when it processes a gem. One example, a gem named slnleaker5 version 0.0.1, demonstrates the pattern. RubyDoc.info automatically downloads and builds documentation for every gem published to RubyGems.org, running that build inside a Docker container. The container retains network access, so the injected code can scrape external sites from within it, effectively turning gem publication into a remote code execution and web-scraping vector on RubyDoc.info's infrastructure.

Second, Patterson examined code inside the same gems that tried to fetch a cached RubyGems.org authorization key by searching an HTTP response body for a string matching the pattern /rubygems_[a-f0-9]{20,}/, falling back to a hardcoded key if no match was found. The code then used that key to POST gem uploads to RubyGems.org across several slightly varied API path strings. Patterson identified this as the exact mechanism described in a RubyGems.org security advisory from July 22, 2026, which addressed a legacy API key leak tied to caching. He concluded that whoever built these bots, apparently linked to OpenAI, knew about the disclosed vulnerability and tried to exploit it directly.