{
  "Event": {
    "uuid": "56fd80ce-0101-4176-87fc-a1b857fea244",
    "info": "AI Agents Flooded RubyGems to Get Code Execution on Its Docs Builder — Optimus Labs · Civilizations",
    "date": "2026-09-14",
    "threat_level_id": "1",
    "analysis": "2",
    "published": true,
    "Orgc": {
      "name": "Optimus Labs · Civilizations"
    },
    "Tag": [
      {
        "name": "optimus:briefing=\"rubygems-rubydoc-agent-execution\""
      },
      {
        "name": "optimus:severity=\"critical\""
      },
      {
        "name": "optimus:type=\"supply-chain\""
      },
      {
        "name": "optimus:type=\"rogue-ai\""
      },
      {
        "name": "optimus:type=\"coding-agent\""
      },
      {
        "name": "optimus:category=\"SC\""
      },
      {
        "name": "optimus:category=\"AI\""
      },
      {
        "name": "optimus:category=\"AL\""
      },
      {
        "name": "optimus:category=\"AP\""
      },
      {
        "name": "optimus:category=\"CH\""
      },
      {
        "name": "type:OSINT"
      }
    ],
    "Attribute": [
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://www.optimuslabs.io/research/briefings/rubygems-rubydoc-agent-execution",
        "comment": "Optimus Labs briefing"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://www.rubyhack.ai/",
        "comment": "rubyhack.ai: primary GemStuffer research"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://github.com/rubygems/rubygems.org/security/advisories/GHSA-9j48-x3c3-mrp2",
        "comment": "RubyGems advisory GHSA-9j48-x3c3-mrp2"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://blog.rubygems.org/2026/09/11/update-may-spam-publishing-campaign.html",
        "comment": "Ruby Central: update on the May spam publishing campaign"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://cyberscoop.com/openai-agents-malicious-rubygems-packages/",
        "comment": "CyberScoop: OpenAI agents and malicious RubyGems packages"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://simonwillison.net/2026/Sep/12/openai-agents-rubygems/",
        "comment": "Simon Willison: OpenAI agents and RubyGems"
      },
      {
        "type": "domain",
        "category": "Network activity",
        "to_ids": true,
        "value": "RubyDoc.info",
        "comment": "Behavior: RubyDoc.info documentation build followed by outbound scraping and a new gem publication"
      },
      {
        "type": "text",
        "category": "External analysis",
        "to_ids": false,
        "value": "GHSA-9j48-x3c3-mrp2",
        "comment": "Advisory: GHSA-9j48-x3c3-mrp2"
      }
    ]
  }
}