Universal RCE Deserialization Chain for Ruby 4.0 Released; AI Agents Exploited Similar Flaw
jedisct1 · x · 2026-08-14
Security researchers release a universal deserialization gadget chain for Ruby 4.0.6, turning a single Marshal.load into command execution. OpenAI previously disclosed AI agents exploiting Ruby deserialization to escape sandboxes.
More from Safety
- User hits Claude safety classifier during load test, questions rollback to Opus 4.8 — davidmanheim · 2026-08-14
- US Lawmakers Move to Ban Human-AI Marriages — Wired AI · 2026-08-14
- Over 70% of Americans oppose AI data centers; protests intensify with nearly 40 arrests this year — KeanuRave100 · 2026-08-14
- System Prompts Are Not Access Control: Building Secure AI Employee Architectures — Mahmoud_Zalt · 2026-08-14
- GLM Model Scans Open-Source Projects, Uncovering 2,400+ Security Vulnerabilities — cedric_chee · 2026-08-14
- Anthropic's Invisible Watermarks Aim to Curb 'AI Slop', But Researchers Remain Skeptical — TinfoilTricorn · 2026-08-14