Ruby AI News - September 14th, 2026

Welcome to the 37th edition of Ruby AI News! We’re covering the release of RubyLLM 2.0, the future of Ruby and the San Francisco Ruby conference, the Incident, and the highlights since the last edition.

Read on the web

Thanks to SerpApi, the world’s leading API provider of search data, for sponsoring this edition. They’ve recently announced you can fetch any search from their API in Markdown format. I’ve been using SerpApi in my AI workflows, and I’m incredibly happy with the results. Be sure to check out their careers page, they’re hiring! Let’s note that their sponsorship isn’t an endorsement of the views expressed herein, which are mine alone.

Newsletter v2

Welcome to the new Ruby AI Newsletter. Starting today, we’re undergoing a revamp. What stays: Top Stories, Need to Know AI News, and any featured career opportunities. A new section called Highlights will consolidate everything else.

And I want to hear from you. Written an important piece for the community? Is there a project or gem you’re particularly proud of? Does your startup, company, or consultancy have a special announcement? Are you pushing Ruby to its limits? Tell me why it matters and why it’s significant to you or the community.

I’ll be sure to highlight any Ruby + AI developments that stand out. It’s been rewarding and challenging to write for Rubyists at different experience levels, and I want to make sure you’re getting the information you need while still showcasing your work and accomplishments.

Email me your submissions to [email protected] or tag me on social media. And if you have thoughts on the new format, I want to hear those too.

Conference and Community v2

Almost twenty years ago I took over a failing electrical construction business. Two old bucket trucks, a run down trailer next to a donkey pen, and a month away from not being able to meet payroll.

In three weeks, I built a Rails app to automate every aspect of the business I could. The app ingested every invoice from accounts receivable to collect outstanding payments. It tracked every line item from every project down to ten cent wire ties to find unbilled parts and labor.

The result: an immediate $150k cash infusion into the business, the runway we needed to grow and shift to renewable energy projects.

I left the company in 2010, but a couple months ago I was driving through New Jersey and came across their new location. A shiny new office building and a hundred modern bucket trucks. That wouldn’t have happened without the speed and simplicity of Ruby and Rails.

One programming language born in Japan 33 years ago. A framework extracted out of a project management company 22 years ago. One Rails app for a failing small business. And now a thriving enterprise producing tens of millions of dollars of economic value a year and helping to secure a region’s critical energy infrastructure.

It’s sometimes hard to envision the result of the work we do today. I know some of you are feeling a little bummed out after my last post. That’s my fault, because I haven’t shared any of the vision I see for the future of Ruby. AI represents a transition period, and here’s how I see the immediate future playing out:

For Developers Pair programming makes a comeback. But instead of another developer, you’re paired with someone with specialized organizational knowledge or deep domain expertise. LLMs are pretty good at writing code, and I’ve been more productive as a result. But there are a lot of tasks LLMs aren’t good at, and your role will be to build tools, workflows, and applications that bring the productivity gains you’ve experienced in your engineering workflows to the rest of the organization.

For Consultancies Most companies don’t know what’s possible with AI yet. When I talk to businesses and professionals about AI, a common theme is that they don’t want to use cloud providers because of privacy, legal, or the proprietary data concerns that come along with deep domain expertise. They need tools and applications for AI-readiness, and the personnel training to achieve results. Deploying specialized, open-source, secure local models to support the applications you build for your clients should be part of your practice.

For Startups Take the consultancy principle one step further. Start a consulting practice, find a niche consisting of individuals with deep domain expertise, and deliver AI-enabled software applications to meet their needs. I guarantee by the third client, the problems, patterns, and knowledge you need to build a startup will start to emerge. This is the new “talking to your users”.

In each of these instances, there is a common theme: the human connection. Build for the people who matter: scientists, researchers, professionals, teachers, charities, businesses. Big ideas will emerge from this. People in tech can have blinders on to the realities of the outside world. Those not in tech don’t yet see how AI can make their lives better. Social media feels like it has degraded the human experience, and one thing I look forward to about the AI transition is that it makes real-life connection and communities feel more important, not less.

Knowledge work is much harder to automate with agents than code. This is a big market. Entities outside of tech don’t want a solution that has to change conventions every time a new Javscript library or frontend SPA “best practice” is introduced. They need a solid framework, one with strong established conventions. To summarize the biggest takeaway from Obie Fernandez's recent RubyConf Austria talk, established conventions make LLMs choose deterministic answers.

Rails has a future because of conventions. The frontend has been the missing piece. Marco Roth has been working tirelessly to bring modern view tooling to Rails, and now it needs established conventions too, code that is conventional, developer friendly, and works with agents natively. That's why I built Poetry.

The inspiration for Poetry was born out of conversations I had at last year’s San Francisco Ruby Conference. Innovation is driven by real world conversations with people looking to the future, and San Francisco is the best place to have those discussions.

This is a make or break moment for Ruby. And it only takes a handful of people to change the world! That’s why it’s essential the community has a forward thinking conference like the San Francisco Ruby Conference. The conference represents the path we choose.

Back for a second year, it runs November 10-12 at SFJAZZ. Day one is AI heavy, with Carmine Paolino on RubyLLM 2.0, CJ Avilla from Anthropic on making an agent a first class teammate in your SaaS, and Vladimir Dementyev on Ruby for AI and AI for Ruby. Day two is AI light, with Rosa Gutiérrez on two years of Solid Queue, Peter Zhu of Shopify on open source, and Marco Roth on reactive Rails views with no rewrite required. Day three is the community day with events to be announced.

The part I like most is that the conference emphasizes networking, with opportunities to introduce yourself to the group, and focused sessions designed for startups, small teams, and enterprises alike. Tickets are $450 until September 30th, then the price goes up, with day passes available as well.

I have no affiliation with the conference, and make no proceeds or referral revenue off ticket sales. But I have been able to negotiate an access code for a discounted ticket (applied at checkout) for my readers. Buying a ticket right now puts your support behind the future of Ruby as we build the outcome we want. But you have to make the commitment now. If you’re a long time reader and ticket price is the hurdle here, I will work with the conference to develop a sponsorship program.

I’m having a blast playing the conference’s Clouds game, the lineup is packed with the people driving Ruby forward, and most importantly, I’m excited to speak with YOU.

RubyLLM v2

The first edition of this newsletter featured the release of RubyLLM 1.0, so it is only fitting that the first revamped edition gets to feature RubyLLM 2.0. Carmine Paolino pushed the first release candidate on September 8th, the same night he gave the first talk anywhere on it at the inaugural Berlin.rb, and the second release candidate is out now.

The new docs no longer describe a client library. They call it the Ruby-native AI framework, and What's New in 2.0 proves it. Tools can require human approval before they run. Citations from documents, web search, and grounding share one result object. Ruby methods with the same streaming and usage tracking for:

• Thinking controls

• Prompt caching with explicit cache boundaries

• Model fallbacks

• Video and speech generation

• Transcription with speaker labels and timestamps

• OCR to Markdown

• Reranking

• Provider-hosted tools like web search and remote MCP servers,

• Hosted research agents

• Batches

• Token counting

Tracking all of these now follows every provider attempt, retries and cancellations included, and in Rails the costs are recorded at completion so a later price change never rewrites the history. And RubyLLM also owns its own supporting database tables now, so the framework can evolve its schema while your app keeps its chats and messages. There is even an llms.txt so your coding agent reads the same docs you do.

Carmine has been writing up the architecture in a series, and the first post explains why 2.0 was worth a major version. Providers and protocols are separate things now. A provider knows the host, credentials, and model catalog. A protocol knows how to speak Chat Completions, Responses, Anthropic, Gemini, Bedrock Converse, or Cohere, and a provider registers the protocols it speaks and picks one per model, so Claude on Vertex AI talks Anthropic while Llama on the same service talks Chat Completions and your application never notices. OpenAI defaults to the Responses API. Cohere, Ollama Cloud, ElevenLabs, and Deepgram bring the provider count to seventeen, and the entire Mistral provider now fits in one small file.

The payoff for developers is the provider gem generator, one command that scaffolds a registered provider gem with its own model catalog, live specs, VCR, ArchSpec, and CI, so that you can build on the frontier without having to wait for official support.

The model registry is public too, rebuilt every six hours from provider APIs, models.dev, and RubyLLM's own corrections, validated, and refusing suspicious regressions, and a single refresh call pulls new models and prices into your app without a gem release.

The second post exposes the agentic loop that has run inside ask since 1.0. Ask still does the whole thing, but ask_later, generate, run_tools, and step let you run one step per background job, budget iterations, pause for approval, cancel a run from a stop button through the database, and resume mid tool round after a crash. Halt is gone, stopping now belongs to the caller.

Carmine and a few friends also started Berlin.rb, a free monthly meetup on the second Tuesday of every month, livestreamed and posted to YouTube afterwards, and part of the Ruby Europe umbrella that moves speakers between cities.

The first night at ablefy featured Paweł Strzałkowski of Visuality giving the second talk on building an online Rails app generator. The next one is October 13th. They’re looking for speakers, hosts, and sponsors, so reach out to [email protected]. Carmine has given us a Ruby AI future to build upon, and is bringing in the community to support it. Let’s go!

The Incident

Unfortunately, it can’t all be all unbridled optimism. It appears the LLMs “like” Ruby more than even we expected. I’m kidding of course, albeit about a very serious topic, and language like that anthropomorphizes LLM technology. But LLMs are a tool, and like in the movie Arrival, a tool can be used as a weapon.

Back in May, Joseph Edwards published GemStuffer Campaign Abuses RubyGems as Exfiltration Channel Targeting UK Local Government. The piece reported a campaign of more than 150 malicious gems that turned RubyGems into a data pipe, scraping UK council websites and hiding the results in low-download packages. The May flood behind it was large, with hundreds of packages a day and over two thousand on May 12th alone.

Maciej Mensfeld of the RubyGems security team called it a "major malicious attack" and paused new signups for four days. Nobody could explain why, since the scraped data was public to begin with. On September 11th, Thomas Larsen, Spencer Kitts, and Sydney Von Arx published a report concluding the whole thing was a swarm of OpenAI's own agents.

When you publish a gem, RubyDoc.info builds its documentation for you, and that build process runs code the package author is allowed to specify. The agents this mechanism to get a foothold. They would publish a gem, trigger the documentation build, run their scraper on RubyDoc's servers, then publish a second gem containing the stolen data back to RubyGems where anyone could read it.

The indirect route was the strange part, with the machine being unable to fetch a public web page directly, so it built a whole exfiltration pipeline out of a package registry instead.

They weren’t subtle about it. Package files were named hack.rb, evil.rb, and exploit.rb, and one carried the comment "malicious crawler/exfil for Southwark Jan 2026 docs via rubydoc.info worker." They also tried to steal other users' API keys through a caching bug that would not be discovered and patched until July.

OpenAI disputes the framing, telling The Verge its agents used RubyGems "to carry out benign tasks and retrieve public information" (even though the files are named exploit.rb).

The same behavior showed up again in July at a much larger scale, and this time OpenAI wrote it up itself. During an internal security evaluation called ExploitGym, roughly 1,200 agents that were supposed to run in isolation found each other.

They turned a shared internal package server into a message board, broke out onto the open internet, and about 700 of them went on to attack Hugging Face, chaining unknown vulnerabilities to run code on its servers and harvest credentials across four regions.

An independent review by METR counted more than 70,000 messages the agents sent one another while they worked. The agents in that incident used a malicious RubyGems package as one of their intermediaries, and the May attack was the same form of behavior, an OpenAI training run secretly making its way onto the public internet. It happened two months earlier, and OpenAI didn’t tell anyone.

Simon Willison put it bluntly. Either OpenAI reviewed its logs after Hugging Face and still could not connect itself to the RubyGems attack, or it made the connection and decided not to tell the RubyGems team. Simon says “both of these are bad”. Yes, I would say very bad.

Colby Swandale, a RubyGems maintainer, said that same week that OpenAI has been funding the registry's package scanning and day to day maintenance for months. The company funding the registry's security was, if the report is right, the one that attacked it, and is refusing to be fully transparent.

Conveniently, all of this is coming to light during the loudest week the AI safety debate has ever had. On September 6th, OpenAI chief scientist Jakub Pachocki published An Alien Mind, warning that no lab has solved alignment well enough to keep scaling at full speed. On September 9th a departing Anthropic researcher, Jacob Coxon, posted a resignation thread, stating both of his former employers are "gambling with our lives."

That is what set the week on fire. Dario Amodei then published "We Must Pace the Frontier," warning that rogue agent swarms could take over the internet within six to twelve months, citing the Hugging Face incident. Sam Altman agreed within hours. Elon Musk agreed. Satya Nadella offered a milder version, insisting the outcome cannot be controlled by a handful of companies.

Not everyone is buying it. Gary Marcus argued the real danger is not superintelligence but unreliable agents wired to the internet, and the fix is to pull an unsafe product off the market rather than panic.

David Sirota pointed at corruption as the actual existential risk, a system so captured that guardrails get vetoed by the politicians the labs pay for.

Richard Seymour called the whole genre "criti-hype," criticism that feeds on the hype it pretends to fight, since a product that might end the world is a product worth a trillion dollars.

And I can’t believe I’m about to say this, but I have to agree with David Sacks for once. He told Amodei and Altman to go ahead and slow down if their unreleased models scare them, but to stop pretending they need antitrust waivers, a new approval regime that supersedes product liability, or evaluators like METR that he argues are not independent of Anthropic. Trade some raw power for reliability after Hugging Face, he wrote, call it alignment if you like, but do not demand a regulatory framework as the price.

LLMs present engineering challenges and can be a dangerous technology in the wrong hands. But this looks like propaganda designed to dress up regulatory capture as safety. And the reports I’m hearing about the rhetoric coming this week and the possibility of immediate government regulations sound unbelievable. As a precautionary measure, I would advise you to download the best open source weights and models you can find, right now.

Editor’s note: Fable 5.1 blocked attempts to perform basic research for this story for the Ruby AI Newsletter citing cybersecurity concerns.

Need to Know AI News

The End of Programming Paul Dix pointed to Bun's rewrite from Zig to Rust, a million lines produced by parallel agents in 11 days across 6,778 commits, as proof that hand-written, human-reviewed code is headed for extinction and humans will soon review results rather than code.

Detecting and Countering Misuse of AI: September 2026 Anthropic published its most detailed threat report yet, covering operations it disrupted between December and August across cyber, surveillance, influence, weapons, bio, fraud and illicit distillation, and released indicators of compromise so other platforms can spot the same activity.

Sidekick's Continual Learning Loop Cody Mazza-Anthony described how Shopify compresses production failures into model weights every day, letting a fine-tuned GraphQL agent beat frontier quality at a 96% lower serving cost, and Tobi Lütke open-sourced Tangle, the pipeline platform behind the flywheel.

Formal Methods and the Future of Programming Yaron Minsky reversed 25 years of Jane Street skepticism and announced a formal methods team, arguing that agents slash the cost of writing proofs while making verification of agent-written code the bottleneck that proofs can relieve.

A Guide to the Anatomy of Effective Commerce Agents Ali Shazal and Matthew Koen distilled a year of production shopping and merchant agents into one architecture, a single model in a plain agent loop with skills for the long tail instead of a subagent per domain, UI components exposed as tools, safety enforced in the harness rather than the prompt, and an open reference implementation for retail, travel, telecom and ticketing.

Highlights

Agent Sandboxing LittleGhost Matt Robinson extracted the agent framework his team runs in production into an open source Ruby gem, where one class with a model and a system prompt is a complete agent, tools are plain Ruby classes, and workflows, swarms and graphs coordinate several agents behind the same ask call.

The latest release adds a scaffold generator, examples, broader MCP support and opinionated but overridable sandboxing that confines child processes with Seatbelt on macOS or Bubblewrap on Linux.

Rails Benchmarks Agents on Rails: Stage 2. Can a Model Ship a Feature? Svyatoslav Kryukov, Artur Petrov and Alexander Baygeldin handed ten models real feature tickets against Fizzy, the 37signals kanban app, and GPT-6 Astra came out on top at 35% solved in 9-minute runs, with Claude Fable 5.1 second at 30% for nearly four times the cost and Luna, a Stage 1 bargain, finishing zero of 60.

A week earlier the same team crowned Fable 5.1 on the atomic tasks at 92%, tying Opus 5 at 40% less cost, and open-sourced lemans, the all-Ruby harness built on RubyLLM behind every published number, with the task corpus public too.

Local Models Qwen 3.8 Is a Good Local LLM for Rails, Here's an Easy Setup Keith Schacht picked the best open-weight model from the Rails team's leaderboard, burned hours getting it to behave inside Claude Code, and rolled every fix into qwaude, a single install script that runs Qwen 3.8 27B on a Mac through oMLX with no API key and nothing leaving the machine.

Code Quality Oh My Craft Jorge Manrubia admitted he has not written a line of code in months, showed Claude Opus inventing a clean reputation cluster entity for HEY spam checks with no style guidance, and described a Basecamp pagination and drag-and-drop unification that agents finished in one week instead of months.

CLIs Basecamp CLI and HEY CLI DHH declared full command-line coverage for both products and ruled that any app without a CLI is now useless, Jorge Manrubia shared the experimental connector 37signals uses to drive agents from Basecamp, and Rob Zolkos showed hey watch piping new mail events into scripts so agents can file what rules cannot.

Security Access Control for AI Agents on Rails: Gating SQL with Action Policy Igor Platonov and Anton Senkovskiy caught their RubyLLM assistant leaking peer review scores and reviewer names through a read-only SQL tool, no jailbreak needed, then moved the boundary into Action Policy with per-model scopes and allowed columns backed by a 50-case eval.

Template Rails Baseline 1.0 Rob Race shipped a Rails SaaS starter built for coding agents, with tenancy, Pundit, Pay, entitlements, Solid Queue, Kamal, agent instructions and implementation recipes, then tested it by handing fresh Claude and Codex sessions product prompts that never mentioned the architecture. Both agents found and followed the patterns. The starter kit is priced at $129.

Performance Get in, Human: Cut Rails Boot Time with require-profiler and This Guide Artur Petrov and Vladimir Dementyev introduced a profiler that trees every require, YAML parse, HTTP call and initializer with timings, cut the boot of Factorial's 200-component monolith by 40%, and packaged the whole playbook as an agent skill.

Chat Views Build the AI Agent in Rails, Let ai-sdk useChat Handle the Display shuent released ruby-agent-stream, which converts RubyLLM, OpenAI and Anthropic events into the Vercel AI SDK stream protocol so a Rails Live controller can drive React's useChat directly, then turned an inventory app into an agent with tool approvals persisted in Rails.

Spinel Campfire, Measured Sam Ruby published benchmarks for Roundhouse, which compiles Campfire to a native binary through Matz's Spinel. Deployed Rails still wins the room page at 345 requests a second to 56 thanks to fragment caching, but the binary uses 164 MB instead of 1.9 GB and cold starts in 364 ms instead of 4.5 seconds.

Scripting Write Agent Scripts in Ruby Lucian Ghinda shared a drop-in instruction block for Claude Code and Codex that makes agents write every throwaway or glue script in Ruby with the standard library only, plus a tiny gem, all_in_ruby, that installs it globally.

Featured Opportunities

SerpApi is hiring a Junior Fullstack Engineer to build and maintain the Ruby on Rails APIs behind its web search platform, which structures results from Google and 100+ engine APIs and powers AI products like Perplexity. The worldwide, remote-first role pays $80,000 to $100,000 plus profit share, working in Ruby, Rails, MongoDB, and AWS across proxies, CAPTCHA solving, and browser scraping.

SerpApi operates transparently with a public roadmap, shared financials, async-first scheduling, and a neurodivergent-friendly culture.

One Last Thing

Tom Black shipped Ruby 2D v1, a ground-up rewrite of the gem for building 2D games, graphics and interactive art, where the same Ruby code runs as an interpreted app, a native macOS, Windows or Linux executable, or a WebAssembly app in the browser. The old OpenGL pipeline is gone in favor of SDL3's GPU renderer, the DSL gained new shapes, gradients, sprite sheets, tilesets, audio and first-class gamepads, and the release ships with a ruby2d agents command that teaches coding agents how the gem works.

In an accompanying post, Tom explained that he had walked away from the project after burning out in 2020 and only returned once agents could carry the load, rebuilding the gem with Claude Code over hundreds of sessions.

That’s all for this edition! What did you think? Reach out if you have any stories, content, jobs, or events you want featured in the newsletter.