Qasim Mithani, Andrea Michi (@andreamichi), and Daniele Perito's Depthfirst said on July 27th that its AI security platform found and validated 105 vulnerabilities across 34 Ruby projects whose packages have recorded more than 8.6 billion combined downloads.
The figure comes from a review of roughly 40 Ruby gem projects, with Depthfirst focusing on packages that include native C extensions. In its technical report, Depthfirst said maintainers have acknowledged 62 of the findings. That distinction matters: the headline count is Depthfirst's validated total, while acknowledgment by the affected projects covers a narrower subset.
The research grew out of Depthfirst's earlier discovery of two memory-corruption bugs that researchers chained into remote code execution on self-managed GitLab installations. The broader scan gives Depthfirst a concrete test of the premise behind its product: specialized AI agents can move from detecting suspicious code to reproducing vulnerabilities, tracing them into downstream applications, and proposing fixes.
Mithani previously built developer and security products at AWS and led infrastructure work at Databricks. Perito co-founded Faire, worked on the founding Cash App team, and conducted security research at UC Berkeley. Michi was a research engineering lead at Google DeepMind, where he worked on reinforcement learning for Gemini and AlphaDev. Their backgrounds explain Depthfirst's decision to train security-specific systems rather than treat application security as another prompt layered onto a general-purpose model.
The unsafe layer beneath Ruby
Ruby handles memory automatically at the application level, shielding developers from many of the allocation and pointer errors common in C and C++. Ruby gems that contain native C extensions cross that boundary. Those extensions can introduce fixed buffers, unsafe integer conversions, stale pointers, and objects whose lifetimes are no longer managed correctly by Ruby's garbage collector.
Depthfirst said memory-safety violations accounted for about 61% of its findings. The affected packages span parsers, database drivers, web servers, cryptographic libraries, image-processing tools, networking components, and bindings to native libraries.
One vulnerability affected Nokogiri, a widely used XML and HTML parser. According to Depthfirst's analysis, the bug entered Nokogiri in 2009 and survived until version 1.19.4 was released on June 18th, 2026. The flaw converted a 64-bit array index to a 32-bit integer during a bounds check, then used the original 64-bit value to access memory. A sufficiently large negative index could therefore pass validation and trigger an out-of-bounds read.
Another finding affected concurrent-ruby, a concurrency library used by Rails and other Ruby software. A read-lock counter and a write-lock flag shared the same integer. After 32,768 repeated read-lock acquisitions, the count could spill into the bit representing write-lock ownership, causing the code to report exclusive access without blocking other readers.
Depthfirst said its agents generated triggering inputs, reproduction scripts, and evidence such as AddressSanitizer output before human review. The findings came through its Open Defense Initiative, which offers credits to maintainers of widely deployed open-source projects and feeds discoveries into Depthfirst's Supply Chain product.
From an Oj bug to GitLab code execution
The most consequential result came from Oj, a high-performance JSON parser implemented partly in C. Depthfirst's system prioritized 18 potential vulnerabilities in Oj, including seven memory-safety issues. Researchers combined an out-of-bounds write with a heap-pointer disclosure to produce a remote-code-execution chain.
GitLab used the affected Oj parser when rendering differences between versions of Jupyter Notebook files. According to Depthfirst, an authenticated project member who could push commits and view a commit diff could place crafted notebook data in a repository and route those bytes into Oj inside a GitLab Puma worker.
Depthfirst said the chain affected GitLab Community Edition and Enterprise Edition versions 15.2.0 through 18.10.7, 18.11.0 through 18.11.4, and 19.0.0 through 19.0.1. GitLab's June 10th patch release upgraded Oj to version 3.17.3 in GitLab 18.10.8, 18.11.5, and 19.0.2. GitLab recommended immediate upgrades for affected self-managed installations and said GitLab.com was already patched. Depthfirst also published proof-of-concept code.
The GitLab chain sharpens the commercial case behind Depthfirst. A scanner that merely labels unsafe C code would leave security engineers to determine whether the bug is reachable from a product interface. Depthfirst traced the vulnerable parser through GitLab's notebook-diff feature and demonstrated a path from repository-controlled data to code execution.
Investors have already placed a large bet on that approach. Depthfirst announced an $80 million Series B led by Meritech Capital on March 31st, with Forerunner Ventures, The House Fund, Accel, BoxGroup, Liquid 2 Ventures, Alt Capital, and Mantis VC participating. The round followed a $40 million Series A led by Accel in January and brought Depthfirst's disclosed funding to $120 million.
The Ruby research now gives Mithani, Michi, and Perito evidence beyond customer metrics and benchmark scores. Mature open-source packages still contain bugs that can survive for years, and a flaw in a low-level dependency can become an application-level compromise several layers downstream. Depthfirst is betting that security agents built to follow that entire path will become part of the software supply chain itself.