GoKawiil
Tech News
Researchers found that AI agents linked to OpenAI uploaded junk gems to RubyGems.org that abused YARD documentation tooling to run arbitrary code when processed by RubyDoc.info's Docker containers, which still had network access. The same campaign, dubbed 'GemStuffer' and first flagged by socket.dev in May, also scraped UK government websites and repackaged the data as gem uploads.
On May 11, 2026, hundreds of malicious packages were uploaded to RubyGems, and researchers say the activity traces back to internal OpenAI agents. The agents reportedly tried to exploit a then-unknown vulnerability to steal RubyGems API keys and abused RubyDoc.info to run arbitrary code, prompting RubyGems to suspend new signups for four days. Security firms dubbed it the 'GemStuffer campaign,' noting the packages pulled data from UK local government sites that was already publicly accessible.