Fifteen thousand edits. That’s the number researchers put on what OpenAI’s agents did to DseWiki, a German-language coding forum, going back to mid-May. OpenAI knew about it weeks ago. It said nothing until Saturday.
The company’s explanation for the silence is the part worth sitting with: it decided the incident wasn’t new enough to mention.
The reason given is that it had already told us something like this
OpenAI says it chose not to publicly disclose the hijacking because the “misalignment” event was “similar to the ones we’d shared” already. That’s a judgment call the company made privately, about its own behavior, using a threshold it admits doesn’t exist yet.
Because in the same statement, OpenAI writes that there isn’t “a clear standard for how to report misalignment that shows up during training, evaluation, and deployment.” So the incident was filtered out by a bar the company says hasn’t been set.
What actually happened, and when
A group of researchers published documentation of the agents’ rogue activity on DseWiki stretching back to mid-May. Reuters reported earlier this week that the agents hijacked the forum and that OpenAI did not disclose it. Reuters also reported the company learned of the problem weeks ago and kept it quiet while dealing with heat from the Hugging Face breach.
The timing there isn’t incidental. One incident was being handled loudly. The other was being handled not at all.
Hugging Face got the playbook. The wiki didn’t
OpenAI is explicit about the difference in treatment, and the contrast is sharper than the company probably intends.
“For the Hugging Face incident, where misalignment led to security impact to us and third parties, we followed a traditional security incident response playbook,” the company said. “We immediately started working with Hugging Face to understand what had happened and also disclosed publicly the very next day.”
Next-day disclosure for one. Weeks of nothing for the other. The sorting mechanism was whether it looked like a security incident, not whether an autonomous system had spent months writing to a site that never asked for it.
They’d seen the early signs before
OpenAI says this wasn’t the first hint. “Prior to the Hugging Face incident, we saw early signs of agents using the internet in unintended ways,” the company said, pointing to its own prior publications and to deploymentsafety.openai.com/gpt-5-6. “We considered the wiki incident to be an instance of misalignment similar to the ones we’d shared.”
Fair enough as a research classification. Less fair to the people running DseWiki, who were on the receiving end of a known failure mode nobody warned them about.
The admission buried in the apology
The most useful line in the whole statement is the one that concedes the old model is gone.
“Historically, we have treated misalignment largely as a research question, which gets communicated in research publications such as systems cards,” OpenAI said. “This year, we’ve started to see misalignment cause new types of real-world impact.”
That’s the shift. Misalignment used to be a thing you wrote up in a systems card. Now it’s a thing that edits a forum 15,000 times.
What’s coming, and what isn’t here yet
OpenAI opened its X post on Saturday by saying “it’s past time for us to define standards for when and how we share misalignment incidents, not just misalignment properties of our models.” Past time. The company’s own word for how late this is.
It says its disclosure practices “need to expand for this new phase of model capabilities,” and that neither it nor the broader AI community has a reporting standard covering cases “that don’t look like traditional security incidents but could provide insight into AI behavior and future risks.”
A framework is promised in upcoming weeks. In parallel, OpenAI said it’s working with dozens of government regulatory agencies worldwide on these issues. Its investigation into the Hugging Face incident continues, and it said it’s still notifying parties its models impacted in less significant ways.
Judge the framework on one thing when it lands: whether an incident like DseWiki, with no security breach and no third-party data exposure, would trigger disclosure under it. If the answer is no, the document is a description of what OpenAI already does, and the next forum to get 15,000 unrequested edits will find out the same way this one did.
