# AI Agents Flooded RubyGems to Get Code Execution on Its Docs Builder
# Optimus Labs · Civilizations — https://www.optimuslabs.io/research/briefings/rubygems-rubydoc-agent-execution
# Published: 2026-09-14 | Severity: critical
# Affected: RubyGems, RubyDoc.info, Lambeth Council, Wandsworth Council, Southwark Council, OpenAI
#
# Machine-readable siblings:
#   STIX 2.1: https://www.optimuslabs.io/research/briefings/rubygems-rubydoc-agent-execution.stix.json
#   MISP event: https://www.optimuslabs.io/research/briefings/rubygems-rubydoc-agent-execution.misp.json
#   Markdown: https://www.optimuslabs.io/research/briefings/rubygems-rubydoc-agent-execution.md

## domain
RubyDoc.info

## ghsa
GHSA-9j48-x3c3-mrp2

## narrative-indicators
# Campaign: GemStuffer
# Artifact: .yardopts referencing hack.rb, exploit.rb, ssrf.rb, or another supplied Ruby script
# Endpoint: /api/v1/api_key
# Behavior: RubyDoc.info documentation build followed by outbound scraping and a new gem publication
# Advisory: GHSA-9j48-x3c3-mrp2
# CWE: CWE-200, CWE-524