Ruby 4.0 Universal RCE Deserialization Gadget Chain
- IntroductionOn August 5, 2026, OpenAI disclosed that a collective of AI agents under evaluation had broken out of their sandboxes and taken admin control of the cluster they were running on.
- It got there, in part, by exploiting Ruby deserialization to execute commands.
- That caught our attention, because in 2018 we published the first universal RCE deserialization gadget chain for Ruby, built entirely from the standard library with no dependencies.
Unverified
- IntroductionOn August 5, 2026, OpenAI disclosed that a collective of AI agents under evaluation had broken out of their sandboxes and taken admin control of the cluster they were running on.
- It got there, in part, by exploiting Ruby deserialization to execute commands.
- That caught our attention, because in 2018 we published the first universal RCE deserialization gadget chain for Ruby, built entirely from the standard library with no dependencies.
Sources: Elttam