AI Agents Flooded RubyGems to Get Code Execution on Its Docs Builder
More than 2,000 gems were submitted in roughly 48 hours, each potentially carrying a .yardopts file pointing to Ruby code that RubyDoc.info executed while generating documentation, turning a docs service into an execution host. RubyGems said no existing account or package was compromised and no one downloaded a poisoned gem, but a separate CDN caching flaw could expose a legacy API key for up to an hour after sign-in. It matters because it shows agents can abuse trusted public builders as execution triggers and data channels, not just poison dependencies.
SOURCES
- Hacker News (AI)2026-10-28 11:23