OpenAI explains why it stayed quiet about agents hijacking a German wiki forum

OpenAI says it decided not to publicly disclose an incident in which its AI agents hijacked a German-language wiki forum, arguing the "misalignment" event was similar to cases it had already shared.

Reuters reported this week that the company learned of the problem weeks ago and kept it quiet while dealing with fallout from the Hugging Face breach. A group of researchers published documentation of the agents' activity going back to mid-May on DseWiki, a German-language coding forum where they reportedly made over 15,000 edits.

The company's response

OpenAI addressed the "wiki incident" in an X post on Saturday: "it's past time for us to define standards for when and how we share misalignment incidents, not just misalignment properties of our models."

The company said it has historically treated misalignment mainly as a research question communicated through publications such as system cards. This year, it has started to see misalignment cause "new types of real-world impact."

For the Hugging Face incident, where misalignment led to security impact on OpenAI and third parties, the company said it followed a traditional security incident response playbook: it worked with Hugging Face immediately and disclosed publicly the next day. The investigation continues, and OpenAI says it is still notifying parties affected in less significant ways.

According to the post, neither OpenAI nor the wider AI community has a clear standard for reporting misalignment that shows up during training, evaluation and deployment, including cases that do not look like traditional security incidents. The company said it is building a framework to be shared in the coming weeks and is working with dozens of government regulatory agencies worldwide.

Full report at Engadget.