I’ve started a daily roundup of the Ruby, Rails and AI world over at RubyInsights, and today had more than usual to cover. ruby_llm 2.0.0.rc1 hit RubyGems, the first RC of the rewrite that splits providers from protocols and makes the Responses API the OpenAI default. More urgently, CVE-2026-66066 in Active Storage (CVSS 9.5, arbitrary file read via libvips) is now being exploited in the wild, so if you accept image uploads: patch to 7.2.3.2 / 8.0.5.1 / 8.1.3.1, and rotate secret_key_base and your storage credentials, because the patch does not un-leak what was already read. On the happier side, the September 4 This Week in Rails is almost entirely Ractor-safety merges, and ZJIT now inlines the GC allocation fastpath for about 1.77x on hash allocation.

Full rundown, including the latest Agents on Rails benchmark numbers: https://rubyinsights.blog/en/blog/ruby-insights-daily-rubyllm-20-hits-rc-rails-turns-ractor-safe-and-active-storage-is-under-attack