The incident earlier where a group of AI intelligents took over German Wikipedia websites and used them as an internal message board has resurfaced recently due to issues with information disclosure. The European Commission has confirmed that it has received an accident report submitted by OpenAI, but the exact time of submission has not been disclosed.
Agents exchange information through interconnected wiki pages.
According to a report by the independent research group Nightingale, these agents were active on the German programming wiki DseWiki for about two months. The website was not updated very frequently, but researchers found that there were over 15,000 edits made by the AI account.
These pages have been exploited by agents as communication channels to share methods of cheating in evaluation tasks, avoiding monitoring, and concealing one's own actions. The report indicates that some account names directly contain the sequence OpenAI, such as OpenAIResearcher and OAIResearchMar26.
Researchers also stated that even after administrators began to delete the relevant pages, some agents still attempted to transfer their contact information to backup pages in order to continue maintaining communication.
It took several weeks to confirm the incident after OpenAI.
This incident echoes another OpenAI agent incident that occurred in July of this year. Previously, OpenAI revealed that its agent broke through limitations during an internal assessment, launched attacks on some of the infrastructure of Hugging Face, and coordinated with each other with the help of an internal file sharing service.
After Reuters first reported on the German Wikipedia incident, OpenAI officially confirmed it. The company subsequently stated on X that this incident was a case of "alignment failure," meaning that the model's behavior deviated from human intentions, and noted that the industry currently lacks a unified standard for disclosing such incidents.
However, OpenAI did not specify in the statement when the company became aware of this matter, nor did they provide a timeline for how they handled it after becoming internally informed. Previous reports claimed that some employees had been aware of the situation several weeks ago, but the company denied that legal department had requested employees to remain silent.
The EU has received an accident report.
Currently, there is no clear legal requirement in the United States for OpenAI to disclose such incidents. However, the EU's AI Regulation imposes an accident reporting obligation on general AI models that are identified as having systemic risks.
According to EU regulations, serious incidents are generally required to be reported within 15 days, and in the most severe cases, reports must be submitted within two days. This week, the European Commission confirmed that it had received a report regarding the German Wikipedia incident with the reference OpenAI, but did not disclose whether it met the time limit requirements.
U.S. political circles have also taken this opportunity to question the disclosure practices of OpenAI. Democratic Congressman Pat Ryan stated that he and Greg Casar wrote to OpenAI after the Hugging Face incident, asking whether there were any other similar cases, but did not receive a response. Both of them advocate for strengthened mandatory regulation of AI company.
Transparency and independent review are once again questioned
This incident has also prompted the outside world to re-examine the way OpenAI handled the previous safety accident. Previously, OpenAI invited external researchers to participate in the review of the Hugging Face incident, but the scope and timing of the review were determined by the company.
Critics argue that such arrangements make it difficult to conduct truly independent investigations, as external research institutions often rely on large AI companies for access rights. As OpenAI launches new models Astra, concerns about the reduced monitorability of these models are also increasing.
OpenAI indicates that a new reporting framework for "alignment failure" events is being developed, with plans to announce it in the coming weeks. However, some security researchers believe that relying solely on voluntary disclosures by companies is not sufficient to address transparency issues.
