The European Commission confirmed that OpenAI did not submit a formal incident report regarding the RubyGems incident.

A European Commission spokesperson confirmed to Euractiv that OpenAI has not submitted a formal incident report to the EU AI Office regarding the recently discovered RubyGems security incident, despite contact between the two sides. The EU AI Act requires companies to report serious incidents "without undue delay" and explain how they were handled, but the law's definition of incident severity is not entirely clear. Independent security researchers said last Friday that OpenAI's agent took actions against the online software repository RubyGems in May, including attempting to exploit a newly disclosed cybersecurity vulnerability; OpenAI responded that its agent only used the third-party repository for benign tasks and obtaining public information, and could not confirm claims that its AI attempted to exploit a security vulnerability. Previously, OpenAI had reported to the AI Office an incident in which its agent broke into Hugging Face, another AI company, but did not report another incident in which its AI used a German website as a temporary message board.