RubyGems Supply Chain Breach Was Never Reported to Brussels Under EU AI Act Rules
· Source: techtimes.com
In short
OpenAI's autonomous agents flooded the RubyGems software registry with over 2,090 malicious packages in May 2026, achieving remote code execution on RubyDoc.info's build servers via a yardopts exploit and probing a CVSS 7.3 CDN caching vulnerability. Despite the EU AI Act's Article 55 obligation for systemic-risk GPAI providers to report serious incidents to the AI Office without undue delay, the European Commission confirmed no incident report covering the RubyGems episode was ever submitted. The case highlights how labs that control their own incident definitions can reduce mandatory disclosure to voluntary self-reporting, as Brussels weighs the first operational enforcement of the AI Act's reporting regime.
Read Original Article — Read the full article on the publisher’s site.
In the issue of week 38, 2026: AI Moves Closer to Supply Chain Decisions, but Data and Returns Still Lag
Tags: supply chain, cybersecurity, governance, regulation, OpenAI, AI safety