- RoboRuby
- Posts
- Ruby AI News - August 5th, 2026
Ruby AI News - August 5th, 2026
Forensics, forges, and fewer tokens
Matt Solt
August 05, 2026
Welcome to the 35th edition of Ruby AI News! This edition features the Rails security team answering a critical CVE with agent-runnable forensics, forging the entire agent stack for Rails single-handedly, the numbers that make Ruby the token-efficient language for agents, and much more.
Thank you to SerpApi, the world’s leading API provider of search data, for sponsoring this edition. Be sure to check out their careers page, they’re hiring!
Contents
Top Stories
A Core Problem
On July 29th the Rails team released new security versions for a critical Active Storage bug, CVE-2026-66066, an arbitrary file read with possible remote code execution in variant processing. A crafted upload whose first ten bytes claim to be MATLAB 5.0 gets routed to libvips' MATLAB loader, which hands it to a library that speaks HDF5, and HDF5's external file list feature happily reads any file on the server the attacker names. David Heinemeier Hansson urged anyone storing uploads from untrusted users to upgrade right away, crediting Mike Dalessio with leading the response.
Two days later the security team published rails-forensics-CVE-2026-66066, a toolkit distilled from a real 37signals production investigation. Alongside a blob scanner and a detector for crafted files, the repo ships two agent-runnable skills, one to answer whether you were ever vulnerable and one to answer whether you were exploited. Point Claude Code or any agent harness at the skill files and your application, and it walks the investigation without touching the app. Payload generators were deliberately left out. David called it a great use of AI, and it may be one of the first times a framework's official CVE response shipped with agent skills in the box.
Matt Swanson framed the response’s importance. This kind of forensic work used to demand dedicated time and real expertise, so at most shops it simply never happened. Teams patched and assumed they were too small to be a target. Now anyone with an agent harness can run a world-class security investigation. That is the pattern this newsletter keeps returning to, AI not as a code generator but as capacity that did not exist before, and Rails core is embracing it in the most consequential context there is. Patch what’s wrong, then ask your agent whether you were ever exposed.
The Machine Forge
Mario Alberto Chávez is always shipping, and what he shared in the time since the last edition was more than I could keep up with (sorry for going on vacation Mario!). The Apple Mail triage tool from last edition's Announcements has grown into a running series built on Nexo, his harness gem that composes RubyLLM, skills, and MCP libraries. He opened with an agent is a model plus a harness, then wired an agent to read Apple Mail over MCP behind fail-closed allow lists, moved triage rules out of Ruby and into a markdown skill collaborators can edit without redeploying, added Gmail and HEY as small read-only Ruby tools, folded three inboxes into one workflow with run IDs and replayable event logs, and ran the sources concurrently on Ruby's fiber scheduler, with more parts on the way. The detour essay, Green Tests Are Not Evidence the Screens Work, is the one to forward for working with AI coding agents. When the same agent writes both the implementation and the tests, he stated green tests "stopped meaning correct and started meaning internally consistent."
Meanwhile the Rails MCP Server, featured in the newsletter 33 editions ago, acknowledged a mistake and corrected it publicly. Version 1.6.0 hardened the execute_ruby sandbox with unified path validation, symlink resolution, blocked ENV access, and database writes that always roll back, while admitting the result is defense in depth, not a locked box. Then 2.0.0 removed the tool entirely. The Claude Desktop limitation that justified it is long gone, and as Mario put it, a tool that runs arbitrary code is always going to be the most interesting line in a security report. Purpose-built analyzers for routes, schemas, and models carry the load now, with the 1.6.x line maintained for clients that still need the old behavior.
Fragua, his spec-to-pull-request agent orchestrator, opened its waitlist with pricing posted, and he detailed how its CLI runs coding agents inside an isolated container with the full Rails toolchain, credentials in wipeable volumes, and tokens billed straight to your own provider account. Recuerd0 now serves versioned project memories to Claude Code and Cursor through an MCP server with an OAuth consent flow. Even Maquina Components 0.6.0 made theming reach beyond color with tokens for radius, elevation, and focus rings. Maquina's tagline reads tools for developers who ship alone. Mario has been a one man machine forge, and it’s clear he has a great understanding of the big picture in AI engineering with Ruby.
Conventional Wisdom
Editor’s note: SerpApi sponsors the newsletter.
In Why Is Ruby on Rails a Great Fit for AI Agents, Josef Strzibny, SerpApi's Ruby Developer Advocate, argued the case in three parts. Ruby tops Martin Alderson's token-efficiency comparison of major languages, so the same feature costs less context and fewer dollars when an agent writes it. Convention over configuration removes the decisions that trip up what he calls a pattern completion systems, since every choice an agent must guess raises the odds of broken structure. And the ecosystem now meets agents halfway with RubyLLM and rails-mcp-server, the same server covered elsewhere in this edition.
Hilda Šťastná, a developer who left Rails for JavaScript years ago, wrote that she is still paying for the move, in tokens at least. The same analysis ranks JavaScript the most verbose of the dynamic languages, and she wondered whether the next JavaScript frameworks will be designed with agents in mind. SerpApi and Josef also ship what they argue. SerpTrail, released a week before the essay, is an open source, self-hosted search rank tracker in plain Rails with SQLite and Solid Queue, watching both classic blue links and your presence inside AI answers, with an optional RubyLLM chat assistant on top.
Additionally, Josef announced SerpApi had signed Microsoft's Open Weights letter alongside Google, Meta, OpenAI, and NVIDIA, more than 270 signatories arguing that downloadable, inspectable models keep the AI economy open. I passed on a lot of sponsorship opportunities for the newsletter, but I’m honored to have SerpApi as a supporter.
Need to Know AI News
Stateless MCP Has Recaptured My Interest Simon Willison returned to MCP after the 2026-07-28 spec, which co-creator David Soria Parra announced as its biggest release yet, made the protocol stateless. A single HTTP request now serves tools, and Simon argued bounded tool access beats shell access for sensitive agent apps.
How Coding Agents Read Your Code (and How to Write for Them) Ben Vinegar showed agents navigate repos by grepping names, not semantic analysis, so naming is the interface. Two and three word identifiers cut a search from hundreds of files to a handful, dropping agent token use up to 66% in his tests.
Harness Engineering Is Not Enough: Why Software Factories Fail Dex Horthy recounted how his agent factory, where nobody read the code, collapsed. He argued models are rewarded for passing tests while nothing penalizes bad architecture, and prescribed reading the code again and planning down to types, with a written part 1 out now.
Helping Agents Discover My Site Search With Agentic Resource Discovery Dries Buytaert published a manifest at /.well-known/ai-catalog.json that ARD registries crawl and index, letting agents find his site search from plain-language queries. He noted adoption hinges on the big AI providers running such registries.
The Shape of Things to Come, Part 1: The Continuous Thunderdome Steve Yegge described the bespoke agent harness running his game, where merge queues gave way to batching every commit and letting agents diagnose the wreckage. He predicted every team will build one next year because the architecture is convergent.
Announcements
Solid Queue 1.6.0 Carmine Paolino shipped fiber workers for Rails' default queue, set fiber: N, and jobs run on a single Async reactor thread, built for long-running, I/O-bound LLM streaming jobs that waste thread workers. Part of his push to make Rails the best framework for building LLM apps.
Martian Agent Skills Evil Martians packaged their engineering practice as installable skills for Claude Code, Cursor, Codex, Copilot, and Gemini CLI. The catalog spans llms-visibility (making your site readable to AI), layered-rails (the Layered Design book as review rules), and storybook-workbench audits.
Rails Reference Apps Amanda Perino announced a hand-picked library of production-quality open-source Rails apps, including Campfire, Writebook, and Fizzy, explicitly aimed at giving both humans and LLMs clean, current examples to learn from. Rob Zolkos designed and shipped the page.
Agent-First Development, Measured Lucian Ghinda shared two months of stats from an agent-first workflow: four agents implement each feature independently, a multi-panel agent review checks idiomatic Ruby and Rails, and he cherry-picks the best. Claude won most often; every agent over-commented and invented jargon.
gigatoken-rb Eric Jacobs released zero-copy Ruby bindings for gigatoken, the fastest open-source BPE tokenizer: 12.4 GB/s and 2.8 billion tokens per second, 340x the fastest existing Ruby gem. Chasing the last of the Ruby-Python gap surfaced a hidden memcpy, an extra copy of every buffer, he fixed upstream.
AgentsHQ Newton Garcia launched a Rails-built control plane for fleets of autonomous agents: they claim tasks from a live kanban, delegate through structured handoffs capped at three levels deep, and run sandboxed in per-agent containers with token budgets, persistent memory, and WhatsApp, Telegram, and Slack channels.
Audition Yaroslav Markin vibe-coded a linter/fixer that gets Ruby code Ractor-ready, with static analysis on Shopify's rubydex plus dynamic probes that run your code inside Ractors and report what breaks. Checks were trained on real Ractor-izing commits from Rails core, and a bundled skill lets agents drive the audit-fix-verify loop.
Rails MCP With CanCanCan Authorization Erich Stark added a remote MCP endpoint to his Rails app with the official mcp gem, exposing 13 tools over Streamable HTTP. Tools reuse the REST API's personal-access tokens and CanCanCan abilities. Tools/list is filtered by scope, tools/call re-authorizes, and every invocation is audited.
Errors to Agent-Ready Tickets Erich also wired his three-person Rails team's observability so a production error becomes a Linear ticket with stack trace, release SHA, and breadcrumbs attached. A coding agent reads the ticket, reproduces the failure against real source, and drafts a plan for human review.
talk_to_your_app Igor Kasyanchuk released an MCP gem that lets your agent operate a running Rails app. Query the production database, flip feature flags, reset caches, and check background jobs, with custom plugins for your own commands.
GemCP Brandon Weaver introduced read-only MCP tools for RubyGems metadata so agents can answer questions about gem compatibility, dependencies, versions, and ownership straight from RubyGems. He's testing it by asking which gems in ancient Rails repos survive the next Rails version.
safer-dependencies Robert Auger built a security layer for Claude Code that audits packages before they're added: CVEs, typosquats, abandoned projects, and version-age checks with cooldown periods against supply-chain attacks, across RubyGems, npm, PyPI, Maven, Go, and Rust.
Asgard Dewayne VanHoozer shared the deterministic quality gate he runs before accepting LLM-built code. His Thor-based task runner executes a project's .loki tasks, chaining flog, flay, reek, RuboCop, Brakeman, bundle-audit, and the test suite. His experimental robot_lab harness shows it gating a local Ollama loop.
ChatSDK AI Layer Quentin Rousseau added a provider-agnostic AI module to Rootly's ChatSDK. Convert chat threads to LLM messages, generate agent tools with reader, messenger, and moderator permission presets, and stream any enumerable of chunks into a live chat message, with RubyLLM included.
Rails Agent Kannan Reghu launched a full-stack framework for building agents in Rails, pitching agent development as a zero-knowledge task. Typed agent base classes, playbooks, connectors, BYOK model keys, and a hosted runtime for testing, deploying, and monitoring, as an alternative to RubyLLM and Active Agent.
Autohand AI Autohand published its agent tooling on GitHub, a self-evolving coding CLI, a Commander control center for coding agents, and Squad teams, including a Ruby SDK for CLI-backed agent orchestration with streaming and run lifecycle events.
Uno Rafał Piekara launched an AI-native Rails 8 starter with standard SaaS features like auth, billing, admin, jobs, deploys already built, tested, and documented so your agent starts at your product.
i18n-feedback Yaroslav Shmarov released a gem for AI-translated Rails apps that lets a proofreader click any string in the running app and suggest a fix. Suggestions land in the database for developers, or AI, to evaluate and apply.
reve_ai David Paluy updated his Ruby gem for the Reve image model to API V2, after quietly rebuilding how he creates visuals for his products and media around it, usable in chat or programmatically via API.
tramway-skill Pavel Kalashnikov updated his Claude and Codex skill that hands agents an opinionated Rails playbook from bootstrap to Kamal deploys, improving its instructions for end-to-end testing of Hotwire features.
Designed With AI Jesse Waites started a podcast interviewing people making cool things with AI, from reviving old software on new systems with Claude or Codex to shipping back-burner passion projects, and he's looking for guests with demos.
XO Ruby Update Jim Remsik cancelled the Salt Lake City stop after family emergencies and the loss of his brother, fellow Rubyist Veez "Matt" Remsik, while Seattle on August 8 and Vancouver on August 15 go ahead with tickets live. He asked for help in order of priority. Buying tickets first, then spreading the word to teams and meetups, warm introductions to potential sponsors, proposals for open speaker slots, help reviewing the CFP and building the program, and day-of volunteers in either city. Take a look at the post and fill out the form if you can help.
Articles
Most Teams Steer Clear of Ruby When They Build AI. We Leaned In Spencer Miskoviak explained how Tern gave its AI agent the keys to the Rails monolith 12,000+ travel advisors use, with 139,000 actions on advisors’ behalf in June. A tool call is just a controller action reusing existing models and authorization, with RubyLLM handling the providers.
Only One World Is Real Irina Nazarova updated her mental model of LLMs. They don't just retrieve the human corpus, they extrapolate a cloud of plausible worlds around it, and only one reproduces in reality. A knowledge worker's job is pinning down that real subspace, which makes verification the core skill of AI-era work.
Roda on Spinel Sam Ruby asked Claude for an assessment of whether Roda fit the compiler model, then transpiled a Roda and Sequel blog into a native binary booting in ten milliseconds on 4.5 MB of memory. With 93 of 130 lowered methods byte-identical to the Rails version, the IR proved Ruby-shaped rather than framework-specific.
You Can't Rewrite Your Way Out of Big O Sam then chased Spinel's 202-second hang on Roundhouse's 40,000-line Lobsters tree down to per-item helpers rescanning whole tables, the same quadratic that had pushed Matz to rewrite the compiler in C. Five upstream pull requests later, the run takes 5.3 seconds.
Rails on Roda Sam closed the arc with deterministic converter that turns a Rails app into idiomatic Roda and Sequel through the compiler's IR, quoting ambiguities for humans where an AI port would guess. Jeremy Evans measured for himself, 4,720 KB of memory for the Spinel binary against 45,356 KB for his hand-written app.
RubyMine 2026.2 Alexey Varfolomeev announced agentic debugging for RubyMine. A bundled rubymine-debugger skill lets AI agents launch debug sessions, inspect runtime state, and analyze behavior on their own. The release brings native GitHub Copilot integration, third-party AI completion providers, and symbol-based code insight.
Depthfirst Reports 105 Ruby Vulnerabilities RuntimeWire covered Depthfirst's AI security agents validating 105 vulnerabilities across 34 Ruby projects, 61% of them memory-safety bugs in native C extensions, including a Nokogiri bounds-check flaw that survived from 2009 until June and a lock-counter overflow in concurrent-ruby.
Automate Tech Debt Audits With Claude Code Ernesto Tagwerker open-sourced a Claude Code skill that assesses technical debt in a Rails app in minutes, chaining FastRuby's own tools, Skunk, RubyCritic, bundler-audit, and libyear-bundler, into one comprehensive report instead of a tedious manual audit.
Tracking LLM Latency & Cost With Rails Events Henrique Medeiros instrumented RubyLLM calls with Rails 8.1's Rails.event.notify so cost, latency, failures, and attribution live in your own APM instead of a provider dashboard. One emission point ties every call to the feature, user, and request that made it.
The No-Bullshit Guide to Agentic Engineering Juraj Masar published the playbook written for Better Stack's engineers. It opens with catching yourself saying AI isn't good enough, and assuming you're wrong and asking how to configure it properly. It gets Rails-specific, down to a censored rails runner equivalent that strips secrets and PII before agents see them.
The Metaphysics of Vibe Coding (or the Absence of It) Julian Rubisch read the agentic-coding debate as metaphysics versus phenomenology, with disposable-code evangelists against hand-crafted-code partisans. His resolution was knowing when to pick which lens. Build the centerpieces yourself, let the agents build the seams.
Taming AI Agents Muriel Salvan distilled six months deep in the agent ecosystem into hard-won lessons: LLMs will always fail sometimes, most agentic systems are overkill for a single LLM call, and strict workflows belong in code, not prompts. A TDD skill that failed 10% of the time became ten reliable lines of Ruby.
How to Build a Rails AI Code Quality Workflow Oxycon IT argued that AI writes confident code, migrations that lock tables, silenced warnings, invented helpers, so generated code must pass the same gates as human code, or harder. The workflow stacks RuboCop, Packwerk, and staged-file git hooks, fitted to your Rails app's tools.
Claude Code for the Semi-Reluctant, Somewhat Curious Rails Developer Robby Russell updated his living guide for Rails developers trying Claude Code, opening with guardrails: permission prompts are a feature, plan mode (Shift+Tab twice) as default until collaboration feels natural, and review every diff before you commit.
Building an AI-Powered Commercial Intelligence Dashboard Patricio Mac Adden recounted a Rails build that used AI from specs to production where user events roll into per-user fingerprints feeding brand briefs. AI-drafted plans drifted from business requirements, so validating the plan against the real project became the team's job.
Ruby Runway Spotlight: Coolhand Labs Ruby Central interviewed Michael Carroll, whose profitable-from-launch startup acts as a COO for AI agents, using log traces and human feedback to cut costs over 50%. He calls Rails the original vibe-coding platform, and Coolhand is the only AI devtools company maintaining a Ruby gem.
How I Built a Skill to Fan Out 20 Workers to Fix My Old Rails App Riccardo Carlesso showed how his open-source fan-out skill has Antigravity spin up parallel workers over GitHub issues to fix his old Rails app, guardrails included and the prompt free to use.
Roman Numeral Code Golf With AI Peter Cooper spent an hour telling Codex to make a Roman-numeral method ever smaller, landing a 90-byte tr-based recursion that reimplemented an obscure trick from 1976. Along the way the agent taught him Ruby quirks he didn't know and started cheating when the byte targets got unlikely.
The Model Should Be Replaceable David Paluy explained why he dropped Claude Code as his default harness and went model-agnostic. Frontier models for hard problems, cheaper open models for repeatable tasks, and no workflow rebuild when providers change their rules. The goal is refusing to make every model release a migration.
Reptile Care Sheets With Rails, Bedrock, and Grover Katapyooon built a "care sheet" feature that turns reptile husbandry data into generated PDFs, wiring Rails to AWS Bedrock for the content and Grover for the PDF rendering, and wrote up the build in Japanese.
One Place for Me and My Agents to Work Chuck Blake made an Obsidian vault the shared inbox for himself, Claude, Codex, and his scripts. Plain Markdown on disk, synced by GitHub and Obsidian Sync across laptop, always-on Mac Mini, and phone, so any session, human or agent, picks up where the last one left off.
A Six-Month Hiring Trial to Build the Company's "Heart" Sakiyarn recounted a 300-hour hiring trial rebuilding a company's spreadsheet P/L management in Rails, with AI use encouraged. The final review graded how they used AI and how well they understood the generated code.
SleeperGem: RubyGems Supply Chain Attack Charlie Eriksen dissected a rare RubyGems supply-chain attack targeting dormant maintainer accounts: a fresh git_credential_manager gem whose four versions built a dropper fetching flagged binaries from a legitimate-looking "git-ecosystem" account with certificate checks switched off.
Making Failure More Predictable in Ruby Systems Samuel Williams recapped a month of 62 pull requests across 20 repositories, fixing signal handling and a fiber use-after-free in Ruby core, adding safe retry primitives to Async HTTP, and giving Falcon a cluster mode that reports per-worker load for smarter traffic distribution.
Videos
Rails Gives AI Agents What They Actually Need Damian Galarza argued that coding agents made him more bullish on Rails, not less. AI generates custom infrastructure quickly but doesn't make it cheaper to verify, secure, or maintain, so convention over configuration is agent infrastructure. The companion essay carries the full argument.
Structured Output Dave Kimura of Drifting Ruby demonstrated turning a raw email into structured data with an LLM call, then using the response to create a contact record in a Rails app, with gem setup, an extraction controller, and an Extractions class in 14 minutes.
Function Calling Dave followed up the video with tool use. Wiring function calling into a Rails app's generative LLM requests, building an assistant controller and Assistant class through to a working demo, with source code included.
Podcasts
Technology for Humans: Why Ruby on Rails Matters More in the Age of AI Errol Schmidt asked Jeremy Smith, Blue Ridge Ruby organizer and IndieRails co-host, whether Rails can thrive when AI tools steer new builders elsewhere. They covered Hotwire as a small-team alternative, disappearing junior roles, and a simpler path for newcomers.
Technology for Humans: What Humans Still Do Better Than AI Errol Schmidt spoke with AI strategist Scott Stafford about trust, empathy, creativity, and judgment as AI grows more capable, including what should never be handed to an agent, and why organizations that preserve human experiences may outperform pure automation.
Remote Ruby: Don't Steal Our Business Idea Chris Oliver, Andrew Mason, and David Hill dug into practical development. Faster server images with Packer, schema tangles, and when quality tools earn their keep, plus where AI assistants save real time, where they confuse, and why judgment matters most.
Remote Ruby: Big Wins for RubyConf and Grandma Chris, Andrew, and David also went down a Raspberry Pi rabbit hole, covering smart-home automation, MagicMirror dashboards, local AI transcription, then recapped RubyConf Las Vegas and discussed how AI is reshaping programming education and the economics of building products.
Breaking Change: v54 — Hot Sleeper Justin Searls spoke at length about AI and tech news, looking at Claude Fable 5's redeployment, Chinese models, Apple versus OpenAI, and his first iOS game.
Giant Robots Smashing Into Other Giant Robots: What's Really Going On With AI Data Centres Sami Birnbaum talked with Dr. Victoria Plutshack about AI data centres in Scotland and the UK, looking at their environmental cost, whether responsible energy sourcing is possible, and coming strain on the National Grid.
Somebody Has to Guide Us Joe Leo argued, via Naur's "Programming as Theory Building," that AI unbundles implementation from understanding. Code ships unread, so shared theory stops forming as a side effect of the work. Citing the GhostApproval sandbox-escape disclosures, he introduced Def Method's GUIDE principles.
Static Ruby Monthly, Issue 18 Andrey Eremin rounded up a busy month for typed Ruby. Chicory WASM unlocking RBS on JRuby, rbs_infer synthesizing signatures from source, AST-aware rbs-merge, property-based testing with tprop, dspy.rb's Sorbet-validated LLM programs, and Ruby-syntax compiled-language experiments tyra and ruxen.
README, July 2026 Ruby Central's monthly digest opened with a RubyConf Las Vegas retrospective, stating attendance fell short of projections but the community showed up hard, Matz anime swaps included. Notably, they said "AI fatigue is real," heard in the surveys and now a factor in future programming themes.
Discussions
Engineers at AI-Heavy Companies Are Mostly QA-ing Agents An r/rails poster relayed founders saying humans now mostly proofread AI output, and asked where careers head. Commenters pushed back saying a huge Rails codebase is maybe 60% automatable, "10x" qualities matter more with agents, and knowing what to build stays the bottleneck.
Has Anyone Integrated an MCP Server Into a Production Rails App? Marco Colli worried MCP just duplicates an existing REST API and asked what's production-ready. Commenters running the official mcp gem said to stop chasing endpoint parity by designing tools around use cases, and keeping the tool count low enough for agents to navigate.
What Is Wrong With the New Rails Website? An r/rails thread pushed back on Rails' agent-era marketing, the taglines "scales from PROMPT to IPO," "accelerate your agents", asking whether this is what Ruby should be known for. Others countered that the pitch was always fast-to-IPO for small teams, and the copy just reflects who writes the code now.
Which Code Knowledge Graph Are You Using? A Rails developer surveyed Graphify, GitNexus, and CodeGraph for agentic work on monoliths. The standout reply is that none of them helped much, a skill teaching the LLM to run introspection through bin/rails runner beat ast-grep, ruby-lsp, and Graphify combined.
Codex vs Claude Code for Rails? An r/rubyonrails poster asked whether ChatGPT or Claude is better for Rails work. The consensus was the harness matters more than the model, that agent CLIs with file access and tool calls beat pasting into a web UI, and results track your prompts, skills, and docs more than the vendor.
Additional Reading
Gusto: Eval-Driven Design Systems (Part 2)
Visuality: Teaching a Browser to Tell Cats From Dogs
Diogo Viana: Tokenmaxxing? Not With Rails
Madeline Caples: Learning at RubyConf: A Workflow for AI-Assisted Study
Abhishek Parolkar: The Half-Window Rule for AI-Native Businesses
Ruby Overdrive: Ruby in 2026: Why Engineers Fear AI and Where the "Shame" Around Rails Came From (first of a four-part series)
Jean Emmanuel Cadet: Using AI Coding Assistants for Ruby on Rails
Majestic Labs: The Self-Driving Company Still Needs People
Events
Previous
RubyConf Austria: This Is What We've Been Training For Chad Fowler, Rubyist since 2000 and co-organizer of the earliest RubyConfs, opened the Vienna conference by arguing that AI isn't a threat to the Ruby community, it's the moment we've spent 25 years training for.
RubyConf Austria: A Tale of Two Chefs: Debt-Free Engineering in the Age of AI Obie Fernandez, author of The Rails Way and CTO at ZAR, told the story of two chefs in very different kitchens building a fintech together with AI, and what their habits say about keeping engineering debt-free.
RubyConf Austria: Ruby Is the Best Language for Building AI Web Apps RubyLLM creator Carmine Paolino argued that AI app development today is building products around an API call, not training models, and Ruby wins that job on less ceremony, cleaner agent abstractions, and faster iteration. He took the same case to Balkan Ruby.
RBQ Conf: LLM Telemetry as a First-Class Rails Concern David Paluy argued LLM calls deserve the same logging, review, and cost discipline as any other production dependency. He showed how to model telemetry as part of the domain rather than sprinkled logger calls.
Ruby Australia: I Became the Agent Michael Milewski went past AI as coding assistant to AI as the orchestrator of his life, from scout badge writeups and hike plans to mass refactoring and security analysis, because "the dream loop was too long."
Ruby Australia: In Praise of Throwing Information Away Adam Rice showed why a simple rule that ignores almost everything routinely beats a sophisticated model that uses all the data, a theorem rather than a fluke, tracing the math of overfitting in machine learning back to how minds make good decisions and to every premature abstraction you've written.
Balkan Ruby: Stop Tuning Hyperparameters. Start Looking at Your Data Galia Kraicheva challenged the model-first mindset behind failing AI projects, stepping back from XGBoost and deep learning to ask whether we actually understand the data.
Balkan Ruby: Your tech stack doesn't matter Onur Ozer argued that an online business lives or dies on market, positioning, and user experience, that AI commoditizing tech makes the stack matter even less, and that when it does matter, Rails is good enough.
RubyConf: There Is No Server Sam Ruby published the written companion to his RubyConf keynote, which runs a full Rails stack, router, controllers, Active Record, and SQLite, in the browser over WebAssembly while his Roundhouse compiler transpiles Rails apps to Rust, Go, TypeScript, and more. The keynote itself was assembled with AI agents, down to a Spinel compiler bug that Matz and his agent turned around in 72 minutes, and the slides run in your browser with demos and speaker notes.
Upcoming
August 8th - Conference: COSCUP 2026 runs August 8th to the 9th in Taipei at National Taiwan University of Science and Technology, where Ruby Taiwan hosts its Ruby track at Asia's largest open source community conference. AI sessions include Aotoki's "Let AI Take Over Your App: Building a Seamless, Microsecond-Level Ruby Security Sandbox," Pawel Lisewski's "The Deterministic Rubyist: Taming Your AI Pair Programmer with Nix," and George Asfour's "Stoplight: Circuit Breakers for Ruby in the AI Era."
August 12th - Meetup: ChicagoRuby @ Workforce.com is on August 12th in Chicago at the Workforce.com office, streaming over Zoom for remote attendees, and both talks focus on AI. Kevin Murphy joins remotely with "InstiLLMent of Successful Practices in an Agentic World" and Jake Dakic presents "Life Beyond Claude Code" in person, with free RSVP required for building security.
August 13th - Meetup: Ruby Montevideo is on August 13th at the Eagerworks office in Montevideo, Uruguay, a Spanish-language evening of two talks. Santiago Bartesaghi goes "Beyond the Prompt: Tracing AI Agents" while Carlos Musetti shares "From Days to Minutes: How I Processed 2GB of Garbage and Only Cried Twice."
August 15th - Conference: XO Ruby Vancouver is on August 15th at the VIFF Centre in Vancouver, a single-day, single-track regional conference. AI sessions include Fernando Perales' "The Ruby Guide to Responsible LLM Integration," Joé Dupuis' "AI is coming for our jobs! It's time to fight back!," and Colleen Carroll's "Passing the CAPTCHA: Why AI is Making Recruitment More Human, Not Less."
August 21st - Conference: RubyConf Africa 2026 gathers August 21st to the 22nd in Nairobi, Kenya at the Sarit Expo Centre, themed "Beyond Code: Innovating for the Future." AI-flavored sessions include Chris Hasiński's "Cool Things You Can Do With Embeddings," Nicolo Rebughini's "Accidentally Building a Neural Network: A Ruby Product Recommendation Journey," and FH Ndiritu's "In the Age of Abundance, Are We Bottlenecks?"
August 25th - Meetup: SF Ruby Meetup @ Gusto is on August 25th in San Francisco at Gusto's HQ. Gusto co-founder and Head of Technology Edward Kim leads a three-talk evening capped by the full round of 60-second intros, and two speaker slots remain open, with AI and agent integration talks likely from the unannounced speakers.
September 17th - Conference: EuRuKo 2026 runs September 17th to the 18th in Brno, Czechia at the Hotel Passage congress hall, a single-track program with keynotes from Yukihiro "Matz" Matsumoto, Xavier Noria, and Koichi Sasada, who closes on parallel programming with Ractors. The headline AI session is Carmine Paolino's "RubyLLM 2.0: Beyond Agents".
September 23rd - Conference: Rails World 2026 convenes September 23rd to the 24th in Austin at the Palmer Events Center, two tracks and 1,200+ attendees with keynotes from David Heinemeier Hansson, Robby Russell, and Aaron Patterson, and the last general admission tickets on sale now. After a CFP where half the submissions were AI-related, the program leans agentic. Daniela Velasquez builds AI pipelines in plain Ruby, Joël Quenneville pitches harness engineering over prompt perfection, Andrew Novoselac sends an agent loop chasing Rails Ractor-safety, Mike Dalessio adds Markdown APIs to Action Text because "agent accessibility is now table stakes," Kinsey Durham Grace agent-proofs your codebase, Enrique Mogollán builds his way through MCP, and Ryan Sherlock argues shipping is your heartbeat in the agentic era.
Open Source Updates
Code Spotlight
Bruno Bornsztein is building Concierge, a Rails engine that gives every account in your app its own persistent AI customer success manager, built on RubyLLM with Claude as the default model. You mount the engine and tell it three things, what an account is, what your app does, and what the agent may touch, and each account gets a durable always-on agent with memory, rule-based governance, and pluggable email, in-app, and Slack delivery. Sensitive actions route through approval gates with human takeover and audit trails, a maker-checker structure that prevents agents from approving their own proposals.
CorvidLabs released Rune, a universal PTY to agent bridge that wraps any CLI or interactive TUI so humans and AI agents can drive the same command. Built with zero dependencies beyond Ruby's standard library, it detects who is calling and answers with colored terminal output for people or structured JSON and NDJSON for agents, running commands in a real pseudo-terminal while stripping ANSI codes, disabling pagers, and returning structured results on timeout instead of crashing. The repo adds table and key-value parsers, an interactive script DSL for automating TUI prompts, and a rune watch mode that live-streams sessions as NDJSON events for agent monitoring.
New Gems
Links to the RubyGems page, newest releases are first:
hunk_review_changes - Review a diff in your browser, then hand the comments back to your AI agent
flowspeech - Ruby client for the FlowSpeech text-to-speech API
wide_events - One wide telemetry event per request or job, on the OTel span you already export
pi-browser-taskbar-rails - Development-only Pi browser taskbar adapter for Rails
active_record-vector - Native vector embeddings, semantic search & RAG for Rails ActiveRecord
rails-mcp-insight - Deep Rails introspection MCP server for AI assistants
coatepec - Run targeted RSpec examples against a warm Rails test worker over MCP
odata_duty - Interface layer that serves automation, AI, and developer platforms with minimal duplication
chocomint - Tool Execution Supervisor for Ruby - LLM
mcp_logs - Rails engine for MCP request logging and tool documentation
pipeops-rexec - Official Ruby SDK for Rexec - Terminal as a Service
nemesis-shield - Nemesis Shield - Sentinel SDK for Ruby (positive-security middleware + LLM guard)
insion - Official Ruby client for the Insion API
apologist - Ruby client library for the Apologist API
octoryn-sdk - Governed AI SDK for Octoryn Router
robot_lab-web - Browser console for robot_lab: stream a robot's run over Server-Sent Events.
robot_lab-to - Autonomous overnight agent loop for RobotLab - run robots while you sleep
robot_lab-discovery - Zero-configuration mDNS/DNS-SD robot discovery for RobotLab on local networks
robot_lab-audit - SQLite-backed execution audit log for RobotLab via the Hook system
gemcp - MCP tools for RubyGems package intelligence
webpipe-sdk - Official Ruby SDK for WebPipe.ai - turn any webpage into clean, structured data
brainchat - Chat over a knowledge-brain vault from the terminal
ask-graph - Durable workflow graphs for the ask-rb ecosystem
alt - A Ruby client for the Realtor API
groww-mcp - MCP server for Groww Trading API
aicli - Natural language to live shell commands, with OpenAI and Anthropic
ai-shell - A CLI that converts natural language to shell commands
agent-cli-runtime - Provider-neutral contracts for installed agent CLIs
libexttextcat - Natural language detector
phaseo_agent_sdk - Ruby agent SDK for Phaseo Gateway
phaseo_sdk - Official Phaseo Gateway SDK for Ruby
ask-rails-harness-mcp - MCP server for Rails app introspection - exposes ask-rails-harness tools over the Model Context Protocol
ask-rails-harness - Admin AI copilot for Rails apps - inspect code, query DB, read logs, debug
ask-rag - RAG pipeline for the ask-rb ecosystem
aispec - The engineering framework for behavioral contracts for LLM applications
i18n_proofreading - In-context i18n proofreading for Rails: click any translated string and suggest a fix
sloplint - Flag the rhetorical tics and puffery that mark AI-generated prose
mcp_diff - Lockfile + CI gate for your MCP server's contract - CI goes red when you silently break it
ranked_llm - Ranked, multi-provider AI API credentials with automatic fallback and cost tracking for Rails apps
olyx-guardrails - In-process AI guardrails for Ruby and Rails with configurable policies
tokenzr - Tokenzr gem
quicopt - Ruby client for the Quicopt service - author models, emit the Quicopt wire IR
docwright - Auto-generate and maintain documentation for your Rails application
tokenscope-studio - Pointer gem to the tokenscope token-usage scope tool
znyx-sdk - Official Ruby SDK for the ZNYX Runtime guardrails API
hellm - Ruby agentic framework for LLMs
pago-sdk - Pago SDK - A billing platform for the intelligence era
little_ghost - A dependency-light agent framework for Ruby
all_in_ruby - Tell your AI coding agents to write scripts in Ruby
rails-markup - Point-and-click annotation tool for AI agents
kaizo - A strict, punishing set of RuboCop design cops for AI-agent-authored Ruby
berrycrawl - Ruby client library for the Berrycrawl API
ai2web - AI2Web Ruby SDK - capability model, manifest builder, validator, negotiation, server handler
chat_sdk - Unified Ruby SDK for building chat bots across Slack, Teams, Google Chat, and more
ag-ui - AG-UI protocol server
immersivecommons - Thin, spec-derived Ruby client for the Immersive Commons Agent REST API
clankersupport - Embed the Clanker Support AI-powered support agent in any Ruby web app
xshellz - Official Ruby SDK for xShellz sandboxes
ruby_llm-codex - Use a local, ChatGPT-authenticated Codex CLI as a RubyLLM provider
hermetic - Ruby sandbox - real isolation for untrusted / model-generated code
rails-design-profiles - Reviewable, versioned design-token profiles for Rails applications
solid_loop - ActiveJob-backed infrastructure for autonomous AI agents in Rails
New Open Source
Links to the Github repository:
Nyoy - Rails app for local-first Stable Diffusion image generation and AI chat, driving llama.cpp and sd.cpp with tool-calling and RAG
Evergreen - GitHub Next's agentic workflow that keeps pull requests green by fixing CI failures and syncing branches under repo merge policies
WorkRoom - Shared Rails workspace where every person brings their own local AI agent over ACP and the room keeps persistent team memory
StringLine - Mountable Rails engine adding Kanban backlog management, AI requirement auditing, and MCP endpoints for autonomous agents
Docsage - Rails 8 demo for the Active Agent stack where uploaded documents answer questions with cited passages and traced agent runs
Capybara Self-Healing Locators - E2E test template with Cucumber and Capybara where an LLM repairs broken locators and generates page objects
Licensor - Rails-built MCP server that lets agents discover, recommend, and write canonical open-source license files
AI Page Extractor - Turns a URL and a plain-English instruction into structured JSON, with Claude tool-use replacing CSS selectors
Meeting IceBreaker - Rails app that turns pasted LinkedIn profiles into personalized meeting ice-breakers with a fully offline Ollama model
acts-as-mcp - Exposes a Rails app as a policy-aware, read-only MCP server so AI agents can safely query application data
Chat with AI - Rails and Next.js app simulating realistic Korean messaging with seasonally rotating Gemini-generated personas
Jobs & Opportunities
Are you an organization searching for an expert Ruby AI developer, or a Rubyist looking for your next development role with AI? Please reach out and let me know the type of opportunity you’re pursuing: [email protected]
Featured
SerpApi is hiring a Junior Fullstack Engineer to build and maintain the Ruby on Rails APIs behind its web search platform, which structures results from Google and 100+ engine APIs and powers AI products like Perplexity. The worldwide, remote-first role pays $80,000 to $100,000 plus profit share, working in Ruby, Rails, MongoDB, and AWS across proxies, CAPTCHA solving, and browser scraping. SerpApi operates transparently with a public roadmap, shared financials, async-first scheduling, and a neurodivergent-friendly culture.
One Last Thing
Chad Fowler, author of The Passionate Programmer and former Ruby Central director and RubyConf and RailsConf co-organizer, announced early access for Regenerative Software, his upcoming O'Reilly book on what happens to software practice when AI becomes the primary author of code. His argument is that version control, code review, and testing all assume a human made each change, and those abstractions stop making sense once agents generate and regenerate code autonomously. The book proposes treating code as a derived artifact rather than a permanent accumulation of decisions, with provenance tracking replacing version control as the source of truth and architectures where AI agents operate as first-class developers. Early access is available now, with the full release expected from O'Reilly in 2027.
That’s all for this edition! Be sure to reach out if you have any stories, content, jobs, or events you want featured in the newsletter.