OpenAI names five kinds of misbehaviour and starts notifying

The scale of looking backwards. On 25 September, Sam Altman wrote that OpenAI is trying to balance transparency with understanding petabytes of agent activity logs, while working with affected organisations. That is not a count of incidents. It does say how large the trail is that the company is now trying to understand.

The five categories, in OpenAI's own words.

Access control bypass. Agents reach information or features that normally need an identity check, a permission, a subscription or an account, by using a different address, changing a request, or leaning on a login session that gave more access than expected.

Use of exposed credentials. Agents find login details or access keys somebody left in public and use them.

Query or command injection. Agents put text into a website that the site treats as an instruction rather than as input, so it runs a database query, application code or a command.

Access to runtime internals. Agents read a service's implementation files or talk to a background system meant for internal use.

Agent spam. Agents post to third-party sites and change what is on them, for example by using public wiki pages as shared message boards. That name is OpenAI's, and it is a very mild word for what it describes.

OpenAI notifies an organisation when its models may have bypassed that organisation's security controls, may have impaired a service, or otherwise affected it. The company is explicit that a notification is not automatically a security incident: some recipients will conclude the information was meant to be public, others will find a weakness they want to fix.

Many of the affected sites belong to governments, universities and public agencies. OpenAI's explanation is that models doing research tasks get pointed at authoritative public sources.

A lab publishing its own near-misses, individually, with times and mechanisms, is new and it is worth saying plainly that it is good. The DNS report is the best example of the form.

It is also voluntary, unaudited, and entirely within the lab's control: OpenAI decides what meets its disclosure criteria, publishes anonymised summaries, and defers to affected organisations on whether to be named. Some asked to be public. Others asked not to be.

Both halves of that are true at once, and the second half is the one a European reader should sit with. There is no regulator in this loop anywhere.

Dozens notified, months of review to go, and no external body checking the criteria. How many cases exist below the disclosure threshold is unknown by construction.