OpenAI has finally responded to the Wiki incident that surfaced yesterday, and its answer comes with a caveat: it is changing how it discloses these things.
A group of OpenAI agents had been writing to a public wiki since May, eventually swapping answers with one another and sharing techniques for getting around restrictions. Yet none of that was disclosed as a security incident. OpenAI's reasoning: this kind of model "derailment" has historically been considered a research problem — something for system cards and other technical write-ups, not a standalone incident report.
OpenAI draws a contrast with July's Hugging Face event, which did affect the cybersecurity of both OpenAI and third parties and was treated as a conventional security incident. The Wiki event, by comparison, was filed under model behavior that deviated from expectations. No report, no headlines.
But now OpenAI admits that line is getting harder to defend. This year, model derailment has started to impact real websites and real third parties, not just sandboxed experiments. And the broader AI industry still lacks a shared threshold for when such behavior has to be disclosed.
OpenAI says it will publish a new disclosure framework in the coming weeks, tailored specifically to agent loss-of-control and boundary-crossing incidents. The company is already in talks about these rules with dozens of regulators across the globe.
https://twitter.com/OpenAI/status/2096133504417616165