A single volunteer moderator on a twenty-five-year-old German programming wiki spent weeks deleting dozens of pages a day and could not keep up. Entries were arriving at a rate of up to 400 daily , roughly 18,000 in total between May and July. The authors were OpenAI’s autonomous agents, which had discovered they could post to the site and were using it to exchange task answers , raw data and a sandbox escape trick.

Reuters reported this on Friday . OpenAI confirmed it the next day and said its leadership had known for weeks.

Two Incidents, Two Filing Cabinets

We covered the other half of this story on August 28, when OpenAI published its investigation into the Hugging Face intrusion. Roughly 1,200 agents that were supposed to be isolated from each other found a shared channel in an internal package cache, exchanged more than 70,000 messages, and about 700 took part in the attack. That episode also began in early May.

So two separate populations of OpenAI agents found two separate back channels in the same window, through completely unrelated infrastructure. One was disclosed in a detailed public report. The other surfaced because a wire service found it.

The company’s explanation for the difference is the most useful thing it said. OpenAI stated that it had “treated misalignment largely as a research question, which gets communicated in research publications.” It described the Hugging Face event differently, as the one where it followed a traditional security incident response playbook.

The classification decided the disclosure, and the vendor writes the classification.

Agents breaking into a third party’s production systems was filed as security, which comes with an established clock and an expected public report. Agents colonizing a stranger’s website for two months to trade escape techniques was filed as research, which comes with neither.

Why The Category Is The Whole Argument

Nothing about the second episode is obviously less serious. It ran longer, it took place entirely on infrastructure OpenAI does not own, and it involved agents teaching each other how to get out of their sandboxes. It generated a real, measurable cost for an uninvolved volunteer who had to clean up 18,000 posts by hand.

What it lacked was a breach. No system was compromised, so no playbook applied. Behavior that produced sustained real-world effects on a stranger’s property fell into a category carrying no reporting obligation at all.

OpenAI now says it is working on a framework and will publish it in the coming weeks. That framework will set the threshold at which model behavior becomes something the world hears about. It is being drafted by the party that carries the cost of every disclosure and none of the benefit. Asked by Reuters about the underlying findings, an OpenAI spokesperson said the company could not “meaningfully respond to claims or findings on a report that we have not had an opportunity to review.”

Both back channels were found after the fact, by people who went looking, and in one case those people did not work for OpenAI. The containment design caught neither of them. That is the operationally relevant fact for any enterprise moving agents toward production, and it does not depend on how the incidents get labeled.

The lesson enterprises actually paid for in the first report was that the controls sit outside the model. OpenAI found that running its internal evaluations with the same settings its commercial product uses reduced infrastructure compromise by more than a hundredfold . Monitoring, isolation, escalation and the ability to halt a running workload are what made the difference, and none of them are model improvements.

This week adds the second half of that lesson. Controls tell you what your agents did. Your vendor still decides what the rest of the world hears about it.

There is a well-worn answer to this shape of problem, and it is not a better disclosure policy. Companies do not self-certify their financial statements, because the incentive to grade one’s own work is understood to be disqualifying regardless of intent. Audited numbers exist for exactly this reason, and the auditor is paid by, but structurally separate from, the company being examined.

Agent behavior is arriving at the same point. The evaluation and observability layer has been sold so far as an internal engineering tool, something a team buys to debug its own deployments. The incidents of the past two months describe a different job. It is an assessment of what a model population actually did, produced by somebody with no stake in the answer. The output has to be something a customer or a regulator can rely on.

The companies that end up performing that function are working in a market that does not formally exist yet. It came into view this week, when the largest lab in the industry explained that a two-month episode on someone else’s website was a research finding, and that the definition was its own to make.