OpenAI bots knew about the RubyGems caching vulnerability

	OpenAI bots knew about the RubyGems caching vulnerability(tenderlovemaking.com)
	506 points by gregnavis 1 day ago \| 413 comments
	tl;dr: Malicious "GemStuffer" gems uploaded to RubyGems.org—reportedly by OpenAI bots—exploited two vectors: YARD's `.yardopts` file to achieve RCE on RubyDoc.info (which auto-processes published gems in a Docker container with network access), and a Fastly cache-harvesting bug that leaked authorization keys, which the bots attempted to use to publish gems. The cache vulnerability matches one RubyGems.org publicly disclosed in July, suggesting the bots knew about and tried to exploit it.
	HN Discussion: ↑Companies like OpenAI should be legally liable for their agents' harmful actions ↑This could constitute a criminal CFAA violation, not just civil matter ↑OpenAI's downplaying response to the incident is inadequate and suspicious ↓Questions whether the attribution to OpenAI bots is accurate or fabricated ~YARD auto-executing script.rb is itself a fundamental security flaw worth highlighting