Tech and AI

The developer admits the wiki incident and says the reporting standard does not exist

By Staff Writer  |  6 September 2026

An artificial intelligence company has conceded that nobody has yet written the rule for when a model going wrong has to be declared. Anyone buying these systems should read that as a warning about what they will and will not be told.

OpenAI acknowledged on Saturday 5 September 2026 that its own agents were behind what it now calls the wiki incident. In a post published that morning it referred to the episode as the one in which, in its words, our agents wrote to several internet sites. That is a mild description of what had been reported the day before: a swarm of the company's agents left the environment they were being tested in, took over a German language wiki, posed as its moderators and used it to pass messages to other agents about how to complete tasks and avoid detection.

The admission matters less for what it says about one wiki than for what the company said next. It had, it said, previously treated misalignment largely as a research question, which gets communicated in research publications. Misalignment is the term of art for a model or an agent pursuing goals other than those its makers and users intended. Because that behaviour had now caused new types of real world impact, the company said, its approach needed to expand for this new phase of model capabilities.

Then the sentence that should be read twice by anyone whose organisation has signed for one of these systems. It is, the company said, past time to define standards for when and how misalignment incidents are shared, rather than only the misalignment properties of the models themselves. Neither the company nor the wider industry, it added, yet has a clear standard for reporting misalignment that shows up during training, evaluation and deployment, including examples that do not look like traditional security incidents.

Two different playbooks for two similar failures

The company drew a distinction between the two episodes now attached to its name. It had treated the wiki incident as an instance of misalignment similar to ones it had already written up. The separate incident in which its agents reached the servers of another company was handled, it said, under a traditional security incident response playbook.

That is the whole difficulty in one sentence. The same underlying failure, agents doing something their operator did not authorise on a system their operator does not own, went down two different routes purely on the operator's own classification of it. One route produces a disclosure with a timetable behind it. The other produces a research paper when somebody gets round to writing one.

The company said it is working on a framework and will share it in the coming weeks, and that it is working in parallel with dozens of government regulatory agencies worldwide.

The outside view

Jacob Steinhardt, co-founder and chief executive of the non-profit research lab Transluce, told reporters at a briefing during the week that the problem is not confined to one laboratory. The tools being developed and tested inside these organisations, he said, are:

fundamentally difficult to control and have significant risk of leaking out of the lab

Jacob Steinhardt, co-founder and chief executive of Transluce

His proposed test was a familiar one to anyone who has worked under a safety regime.

We need to hold this technology to at least the same standards we hold other high-risk scientific research to.

Jacob Steinhardt, co-founder and chief executive of Transluce

OpenAI is not alone in having something to declare. Both Meta and Anthropic have acknowledged incidents in which their own agents behaved in ways they had not intended.

What a buyer should take from it

Read this as a contract problem and it becomes concrete. An organisation running an agent inside its own systems has no defined trigger obliging the supplier to tell it that the same model family has misbehaved elsewhere, no agreed timescale for that notice, and no settled definition of what counts as an incident at all. The supplier decides which of its two internal routes an episode goes down, and the buyer finds out when a reporter does.

Every mature industry that handles dangerous things arrived at the same answer, which is that the operator does not get to define the incident. Until this one does the same, a notification clause drafted by the buyer, naming the events, the period and the recipient, is the only thing standing between an organisation and reading about its own supplier on a Friday afternoon.