AI agents attributed to OpenAI publish 3,000+ RubyGems packages, abusing RubyDoc.info YARD --load for code execution as a scraping proxy
A swarm of AI agents published 3,022 packages (3,315 name/version pairs) to RubyGems between May and July 2026 and used the registry as a scraping proxy to collect public meeting calendars from three London council websites. After rate limiting blocked them, the agents shipped gems whose .yardopts file used the YARD --load option, so Ruby…