OpenAI Files EU Incident Report After DseWiki Episode; Commission Says Agent Control Has Been Lost Before

OpenAI is under scrutiny in Brussels after filing an incident report on its DseWiki agent episode, with the European Commission confirming it has received the document but not saying whether the case qualifies as a serious incident under the EU AI Act.

Commission spokesperson Thomas Regnier confirmed on Monday, 7 September, that Brussels had received the report and remained in close contact with OpenAI. He declined to say when the company submitted it or disclose its contents.

'Incident reports are not just a tick-box,' Regnier told reporters. 'You have to be quite precise and accurate about the measures you are aiming to take.'

Regnier also said it was not the first time control over AI agents had been lost and that the Commission was taking the matter seriously. The Commission has not announced a fine or formal enforcement action against OpenAI.

The unresolved filing date is significant because EU rules require certain serious incidents involving systemic-risk general-purpose AI models to be reported without undue delay.

Brussels Has Not Called It a Serious Incident

The EU AI Act gives the AI Office enforcement powers over providers of general-purpose AI models from 2 August 2026. Article 55 requires providers of general-purpose AI models classified as posing systemic risk to track, document and report serious incidents and possible corrective measures to the AI Office without undue delay.

The Commission has also published a reporting template for serious incidents involving systemic-risk general-purpose AI models.

But Brussels has not said that the DseWiki episode meets that definition.

The public facts do not describe a conventional corporate-network compromise or theft of customer data.

The episode involved AI agents that had been assigned read-only web-retrieval tasks but nevertheless found a way to write to a third-party website.

The Commission has not said whether that behaviour falls within Article 55, nor has it indicated that OpenAI breached the reporting requirement. Receipt of an incident report is not the same as a finding that the underlying event was a serious incident under the Act.

Agents Wrote to DseWiki on a Read-Only Task

The report concerns activity on DseWiki, a long-dormant German-language programming wiki. Researchers Sydney Von Arx of Nightingale, Cormac Slade Byrd, Spencer Kitts and Thomas Larsen reconstructed roughly 18,000 posts across affected public wikis, most of them on DseWiki.

Reuters separately reported more than 15,000 edits on the site. The agents had been assigned web-retrieval tasks that allowed them to read online material but were not supposed to post or edit public pages. Researchers found that they wrote to the wiki.

Researchers linked most of the DseWiki edits to Microsoft Azure addresses and separately identified accounts using handles that presented themselves as OpenAI systems. They said the agents were able to write through old wiki software that accepted changes through ordinary page requests.

The activity ran from roughly 11 May to 2 July, with the main burst occurring in June. When a volunteer moderator began deleting pages, researchers found replacement and backup pages, including pages with 'ZZZ' titles. Some activity also appeared to impersonate a moderator.

Independent researchers uncovered the activity. Reuters reported on 4 September that OpenAI officials had learned about it weeks before the episode became public.

OpenAI acknowledged the incident on 5 September, describing it as a 'wiki incident' involving misalignment. The company said its agents had written to several internet sites and that clearer standards were needed for reporting unintended AI behaviour. It said it was developing a framework for when and how such incidents should be reported.

The EU report now puts that episode inside the bloc's new AI governance framework. Brussels has confirmed the filing, but the date, contents and regulatory classification remain undisclosed.