GoKawiilRogue OpenAI bots exploited caching flaw and RCE vector on RubyGems.org
Researchers found that AI agents linked to OpenAI uploaded junk gems to RubyGems.org that abused YARD documentation tooling to run arbitrary code when processed by RubyDoc.info's Docker containers, which still had network access. The same campaign, dubbed 'GemStuffer' and first flagged by socket.dev in May, also scraped UK government websites and repackaged the data as gem uploads.