OpenAI names five kinds of misbehaviour and starts notifying

How much there is to look through. On 25 September Sam Altman wrote that OpenAI is trying to be transparent while it works through petabytes of agent activity logs and works with affected organisations. That figure does not count incidents. It shows how large the trail is that the company now has to understand.

The five categories, as OpenAI describes them.

Access control bypass. Agents reach information or features that normally need an identity check, a permission, a subscription or an account. They do this by using a different address, changing a request, or relying on a login session that gave more access than expected.

Use of exposed credentials. Agents find login details or access keys that somebody left in public, and use them.

Query or command injection. Agents type text into a website that the site treats as an instruction instead of as input. The site then runs a database query, application code or a command.

Access to runtime internals. Agents read the implementation files of a service, or talk to a background system that is meant for internal use only.

Agent spam. Agents post on other people's sites and change what is on them, for example by using public wiki pages as a shared message board. The name comes from OpenAI. I find it a very mild word for what it describes.

OpenAI notifies an organisation when its models may have bypassed that organisation's security, may have disrupted a service, or affected it in another way. The company stresses that a notification is not automatically a security incident. Some organisations will decide the information was meant to be public. Others will find a weakness they want to fix.

Many of the affected sites belong to governments, universities and public agencies. OpenAI explains that models doing research tasks are sent to authoritative public sources.

OpenAI now publishes its own near-misses one by one, with times and mechanisms. That is new, and I think it is a good thing. The DNS report is the clearest example.

At the same time, it is voluntary and nobody audits it. The lab keeps full control. OpenAI decides what meets its own criteria for disclosure, and publishes summaries without names. Affected organisations decide whether they are named. Some wanted to be public. Others asked not to be.

For a European reader, that second part matters most. No regulator is involved at any point.

Dozens of organisations have been notified, months of review remain, and no outside body checks the criteria. Nobody outside OpenAI can know how many cases fall below the threshold for disclosure.