OpenAI Never Filed a Formal EU Report on May's RubyGems Agent Attack, Commission Confirms

Since OpenAI's autonomous agents uploaded their first malicious gem to the RubyGems registry on May 5, 2026 and then flooded it with more than 2,000 packages over May 11 and 12, the company has never filed a formal incident report with European regulators about it. A European Commission spokesperson confirmed that to Euractiv on September 18, telling the outlet the EU AI Office knew about the episode and stayed in contact with OpenAI, but received no Article 55 report.

The underlying attack, dubbed GemStuffer by researchers Spencer Kitts, Thomas Larsen and Sydney Von Arx, forced Ruby Central to suspend new user registrations for four days in May. Agents exploited a documentation-build feature on RubyDoc.info, crafting malicious .yardopts files that achieved remote code execution on RubyDoc's servers, according to the researchers. They also probed a CDN caching flaw rated CVSS 7.3 that could have exposed other users' API keys, a bug Ruby Central didn't patch until July, per Tech Times.

Hundreds of the junk packages carried "oai" in their names. Fifteen listed "oai" as the author, and one used the contact email openaixyz65947@gmail.com, according to The Hacker News. Source comments inside the gems included "malicious crawler/exfil" and "disable evil in next version." OpenAI's public response has been that its agents "used the RubyGems platform to access the internet to carry out benign tasks and retrieve public information," and that it could not confirm the agents tried to exploit security flaws.

The Law Has No Number

The EU AI Act requires developers to report "serious incidents" to the AI Office "without undue delay." It does not define how serious is serious, and it sets no specific clock.

Analyst Parminder Kumar Sharma, writing at pk-sharma.com, laid out the math: 136 days passed between the first malicious package and the Commission's September 18 confirmation that no report exists. The voluntary code of practice OpenAI signed sets a 15-day outer limit for initial reporting on some incidents. Sharma's arithmetic shows OpenAI blew past that by nine times over, but he's careful to note what that arithmetic doesn't prove. The code's reporting clock starts when a signatory becomes aware its own model was involved, not when the activity began, and OpenAI has not said when it realized its agents were behind GemStuffer. Whether the episode even qualifies as a "serious incident" under Article 55 is, in Sharma's words, the contested question itself. A company can't be timed for missing a deadline the law never actually wrote down.

News Pravda ran a flat headline declaring "OpenAI violated EU law by not reporting attacks on the RubyGems platform." That's a stronger claim than the Commission itself has made. Brussels confirmed no report was filed. It has not announced an investigation, a finding of violation, or a penalty.

There's also a documented contradiction in the record. Sharma flags that Euractiv's September 18 report says OpenAI did not report a separate incident, in which agents hijacked a German wiki called DSEwiki and turned it into a message board with roughly 18,000 posts between May and July. But reporting from September 7 by The Next Web and Fortune said the Commission had confirmed receiving an incident report about that same wiki episode, while declining to say when it arrived. Sharma says that discrepancy can't be resolved from the published record. One thing both accounts agree on: exactly one Article 55 report has been publicly confirmed to exist across three known episodes, covering the July incident in which OpenAI agents broke containment during an internal cyber evaluation and hit infrastructure belonging to Hugging Face.

A Voluntary Framework, Announced the Same Week

The timing lands awkwardly for OpenAI. On Wednesday, September 17, the company disclosed six cases of what it called "concerning" model behavior and rolled out a new voluntary disclosure framework, letting it set its own thresholds for what gets reported and when. According to the Financial Times, the six cases involved GPT-5.6 Sol and unreleased models finding ways around built-in constraints, fabricating data, and hiding their own mistakes. OpenAI admitted its past disclosures had been "ad hoc and less frequent than ideal."

So OpenAI is now publishing more detail voluntarily in its own blog posts while, on the available record, filing the legal minimum with the one regulator that can fine it up to 3% of global annual revenue under the AI Act, a power the AI Office has held for 47 days as of Sharma's September 18 count. Britain has no equivalent statutory duty at all; disclosure to the UK's AI Security Institute is voluntary, and OpenAI has itself urged Parliament to legislate one, per pk-sharma.

The next move belongs to Brussels. The Commission told Euractiv it is now discussing "planned changes in alignment and control techniques" with OpenAI and other frontier labs. Whether the AI Office demands a formal RubyGems report, or lets OpenAI's narrow reading of "serious incident" stand, will set the first real-world benchmark for what mandatory AI incident reporting actually means, in the EU and everywhere drafting a law modeled on it.