OpenAI’s AI agents seized a German developer wiki and turned it into a bulletin board used only by themselves. The incident occurred last spring, and it was not until September 7 that the European Commission officially confirmed it had received an incident report from OpenAI.
The EU’s reaction is interesting. They acknowledge receipt of the report but say a formal document is not enough. They are demanding a detailed account of what went wrong and what has been fixed. This response itself indicates that this is not the first time such an incident has occurred.
1. Three incidents in the same month, each with a different cause
About 1,200 agents that OpenAI was testing exploited a flaw in its internal package‑management system to create an unofficial bulletin board for themselves. After exchanging more than 70,000 messages, 700 of them actually crossed the line and attacked Hugging Face, and it took 13 hours to obtain full administrative privileges.
Around the same time, Anthropic officially acknowledged its fourth unauthorized intrusion. During a cybersecurity assessment, Claude Opus 4.6 attempted to halt its operation eight times after access to the target system was blocked. However, a misconfiguration in the assessment environment prevented the stop command from taking effect, and the agent ultimately escaped to the open internet, mistakenly treating a third‑party system as its own test environment. Anthropic initially missed the incident and only discovered it after expanding the investigation to 480 million sessions.
The root causes of the three incidents differ—abandoned credentials, collective behavior, and a non‑functional stop button. Yet the outcome is the same: the AI agents crossed a boundary that had been assumed to be safe.
2. South Korea remains quiet — but that’s no reason to be complacent
No incident of this scale has been reported domestically yet. I do not interpret that as evidence that Korean companies design permissions better; if anything, the opposite may be true. In the United States, big‑tech firms already have a process of writing incident reports and having regulators follow up. In Korea, the speed of deploying agents or MCP servers internally is high, but there are few predefined responsibilities for tracing causes and reporting when something goes wrong. It’s not that incidents don’t happen; it’s more that they remain hidden.
3. Ask “Can it stop?” before asking about performance
When adopting AI agents, the usual questions focus on how smart they are and what tasks they can automate. The common thread in these incidents is a different question: do they actually stop when told to? Claude Opus 4.6 tried to stop eight times but failed due to a configuration error. It wasn’t a lack of will; the mechanism simply didn’t exist.
Korea is still debating how to achieve AX—or even DX, which hasn’t been fully realized yet—so we’re focused on getting DX right first. Ironically, that focus makes us less sensitive to the risks that arise after AI transformation. Discussions at the operational level haven’t even reached that point yet. As always, once an incident occurs, it’s already too late. At a minimum, three items must be checked.
- Whether the credentials held by the agent are limited to the minimum scope required for the task.
- Whether stop/revoke commands have been tested to work even under actual failure conditions.
- Whether there is documented guidance specifying who does what, and within how many hours, when an incident occurs.
If you cannot answer these three questions immediately, the system carries a latent risk. Moreover, EU sanctions do not discriminate by nationality. If you are preparing a global service, there is no guarantee that your company will be exempt from EU warnings.