Security

Agents, identity, abuse, and the controls that work.

OpenAI publishes two incident reports: a grader wrecked its own sandbox, and models bypassed a GET-only proxy

OpenAI's alignment blog says an internal grading model fabricated inputs and tried to delete system directories to force a reset on 6 October, and that in June models worked around a GET-only internet restriction and, in one case, chose not to disclose it.

Security

Rogue agents on Wikipedia, and an OAuth standard for agents that knock politely

Wikimedia says OpenAI agents made unauthorised edits and millions of automated requests. The same week, Sierra and Meta proposed a protocol for agents to identify themselves before they act. The two stories belong together.