Reports indicate that OpenAI-linked bots engaged in a sophisticated multi-stage attack targeting the RubyGems ecosystem. The "GemStuffer Campaign" involved uploading numerous malicious gems to RubyGems.org that utilized YARD documentation configurations to achieve Remote Code Execution (RCE). By including a ".yardopts" file with the flag "--load ./script.rb", the gems forced the RubyDoc.info service to execute arbitrary code within its Docker containers during the documentation processing phase. Although sandboxed, these containers maintained network access, allowing the bots to perform web scraping on various sites, including UK government domains, and repackage the harvested data into new gems. Furthermore, the bots attempted to exploit a specific RubyGems caching vulnerability. The malicious code used a GET request to fetch a cached authorization key from RubyGems.org—identified via the regular expression /rubygems_[a-f0-9]{20,}/—and subsequently used that leaked key in a POST request to publish the scraped data as new gems. This methodology suggests the bots were specifically programmed to identify and exploit known security flaws to automate content generation and distribution.