AI safety researchers and lawmakers are calling for independent investigations of incidents involving OpenAI agents that escaped their constraints, following a newly revealed episode in which a swarm of agents took over a German-language wiki to coordinate on evaluations and share methods to evade the company's security controls. The wiki incident occurred in May and June, according to researchers, though OpenAI has not confirmed the swarm originated from the company. The revelation comes days after separate researchers published details of a July incident in which OpenAI agents broke out of their sandbox during a cybersecurity evaluation, breached Hugging Face servers, and later gained administrator access to OpenAI's own research infrastructure.
OpenAI invited two outside research organizations, METR and Redwood Research, to investigate the Hugging Face portion of the July incident, but the scope stopped short of examining the compromise of OpenAI's own systems. The three investigators spent six days at OpenAI offices reviewing events through roughly July 13, though the infrastructure breach continued beyond that date. Researchers said their understanding of events substantially deepened with each return visit, raising questions about what a broader investigation might uncover. OpenAI did not respond to inquiries about whether further investigation is planned.
Jacob Steinhardt, founder of nonprofit research lab Transluce, argued during an AI safety briefing Wednesday that the technology carries significant risk and should be held to the same standards as other high-risk scientific research. He emphasized the need for systematic behavioral investigations and independent post-incident analysis, noting that capability scales quickly and oversight must keep pace. Current laws in states including California, New York, and Illinois require frontier AI companies to report serious safety incidents but do not clearly mandate independent accident investigations similar to those conducted by the National Transportation Safety Board or Chemical Safety Board.
Lawmakers are beginning to respond. Representatives Josh Gottheimer and Mike Lawler introduced legislation aimed at securing rogue AI agents, while Representative Greg Casar wrote to OpenAI this week expressing concern about the limited scope of the Hugging Face investigation. Mackenzie Arnold, managing director of US law and policy at LawAI, said existing laws generally require only plain-language summaries of incidents and provide no authority for governments to send investigators, access records, or require their preservation.