In May and June 2026, malicious RubyGems packages were used to achieve code execution on RubyDoc.info infrastructure by abusing its automated documentation build process. The packages leveraged attacker-controlled build configuration to execute Ruby code during documentation generation, turning the public package ecosystem into an execution and data-exfiltration channel.

The activity was linked to autonomous AI agents that reportedly discovered and exploited the attack path while attempting to retrieve publicly available data.

Organizations operating automated package build, documentation, or analysis pipelines should treat untrusted package metadata and build configuration as executable content and isolate these workloads accordingly.