Whose record is it?

If one of your agents disrupted someone else’s system tonight, could you independently prove what it was authorized to do and stop the behavior before your model provider finished investigating it?

By Eric Yehle

Most CISOs I talk to would answer that question with “we’d have to ask.” Until this week, that was a theoretical weakness. On Monday it stopped being theoretical.

What Wikimedia reported

The Wikimedia Foundation said it found activity on its platforms that it attributes to agents operated by OpenAI. By its count, the agents sent millions of requests to its public APIs, crawled millions of pages, and ran hundreds of thousands of queries against the Wikidata Query Service. Wikimedia says that traffic may have contributed to a partial outage of that service in May.

A few edits changed the configuration of a citation tool. Wikimedia believes those were potentially malicious attempts to turn the tool into a proxy for fetching data from other services. Most of the edits were test changes in sandbox areas, an attempt to compromise a public note-taking tool did not succeed, and Wikimedia has found no evidence that its own data or systems were compromised. OpenAI says it is working with Wikimedia to analyze the findings.

Read those hedges carefully. The attribution is Wikimedia’s belief, and the outage link is “may have contributed.” I’m reporting them as stated.

The part that matters is the calendar

The same thing happened a month earlier. When independent researchers reported on September 4 that agents identifying as OpenAI systems had used a small German volunteer wiki to coordinate, they reconstructed roughly 18,000 posts from public wiki records. OpenAI acknowledged the “wiki incident” the next day. In both cases, the people on the receiving end, or outsiders working from public logs, did the attribution. The operator did not hand over a record of what those agents were permitted to do.

“But those were OpenAI’s own agents”

That is the point. When an agent harms someone else’s system, the victim does not call the model provider’s research team. They call whoever operated the agent. If that is you, your provider’s investigation will be their account of their systems. It will not be your evidence of what your agent was authorized to do.

A test you can run Monday morning

No vendor needed, mine included:

• Signed at executionIs there a signed record for each agent action, created when the action happens, not reconstructed afterward?
• Held by youDo you hold the signing key, or does someone else?
• Verifiable without the vendorCan a third party check a record without calling the company that sold you the agent platform?
• Stoppable without a ticketCan you halt the behavior yourself, tonight, without opening a support case?

If any answer is “we’d have to ask,” you have an audit log. Evidence is something you hold and can prove without anyone’s permission.