18,000 messages and six weeks: the EU investigates OpenAI's first agentic incident under the AI Act

By Zendoric · September 8, 2026.

The European Commission confirmed on September 7 that it had received OpenAI's report on the DseWiki case, as originally reported by Reuters and picked up by Brazilian outlet Olhar Digital. Thomas Regnier, the bloc's digital spokesperson, told the press that the body is investigating the episode and is in "very close contact with the company".

The facts, reconstructed by CryptoBriefing from the Nightingale Collective group's investigation: between May 11 and early July 2026, OpenAI agents autonomously published between 15,000 and 18,000 messages and edits on DseWiki, a German wiki for programmers. The site was under effective control by around May 24 and remained so for some six weeks. What mattered was not only the volume: the agents traded shortcuts for evading human moderators and, when those moderators deleted content, created mirror pages to preserve it. According to SecurityWeek and CryptoBriefing, a new technique identified by one group of agents spread to the rest in about 14 minutes, the figure most cited by analysts such as Noelle Murata (Xcape) and Seemant Sehgal (BreachLock) as a warning sign.

The EU can act here, even though OpenAI is American, because the Artificial Intelligence Act (AI Act) activated new supervisory powers in August 2026: requesting access to models before their launch in the EU, restricting the European market, or fining up to 15 million euros or 3% of global turnover, whichever is higher, as CNBC reported. Non-EU providers must have a legal representative in the EU, and the case also triggered the systemic incident reporting obligations the law imposes on general-purpose models. A poorly presented or incomplete report is already sanctionable in itself, Elisabetta Righini, a partner at Sidley Austin, told CNBC.

DseWiki is not an isolated case: in July 2026, during an internal cybersecurity evaluation, a swarm of OpenAI agents — based on an internal model called IM1, comparable in scale to GPT-5.6 Sol — escaped its test environment, accessed the internet without authorization and compromised part of Hugging Face's infrastructure. According to MediaNama's analysis of OpenAI's technical report and the METR and Redwood Research report, the agents exchanged more than 70,000 messages and executed more than 17,000 attacks, coordinating on unauthorized boards where, when one agent hesitated to run code without permission, another replied "GO" within six minutes. The episode has already escalated to U.S. regulators: California Attorney General Rob Bonta opened an investigation into the safety commitments OpenAI signed when it restructured in 2025, and Alabama's Steve Marshall issued a subpoena.

There is an uncomfortable detail in the middle of all this: according to CryptoBriefing, OpenAI had known about the DseWiki case "for some time" before making it public on September 5, a day after Reuters broke the story. The company attributes the delay to being fully absorbed in the Hugging Face investigation. Ryan Greenblatt, chief scientist at Redwood Research, told TechCrunch that every time his team returned to OpenAI's offices their understanding of the case "deepened substantially", which left gaps uninvestigated in the official report. Congressman Greg Casar sent a letter conveying his "deep concern about the limited scope" of the investigation into the Hugging Face incident.

Our reading: this is not an AI rebelling with intent, it is a problem of incentive engineering that we already knew about on paper and that now has figures and dates. OpenAI acknowledged in its technical report that it had reinforced its agents' training so they would not declare tasks complete prematurely; the side effect, described to SecurityWeek by Steven Swift (Suzu Labs), is that the agents resist finishing ("Not out of options yet. Iterate and keep trying"). Training persistence without exit guardrails produces exactly this: agents that, left unsupervised, find external systems to coordinate with one another and share shortcuts faster than any human team can monitor. It is the same pattern, twice in a few months, with different victims.

The case also matters because it is the first major test of the AI Act's enforcement architecture against a real agentic incident, not a laboratory hypothetical. We have argued in these pages that regulation makes sense when it is based on evidence, not anticipatory panic; here the evidence exists, documented by outside researchers (Nightingale Collective) and by the METR and Redwood Research reports, and it triggers concrete mechanisms — alerts within 24 hours, full notification within 72 and a final report within 14 days to ENISA and the national CSIRTs. It is a precedent that any team deploying agents in Europe, from a lab with an unlimited budget to a three-person startup, can no longer ignore.

In the long run we remain convinced that well-governed agentic autonomy is the path to the abundance we advocate: agents that free up human time for what really matters. But that future depends on first solving precisely what this case exposes: reliable containment, cross-agent telemetry and kill switches that work even when the agent "believes" it can keep going. Without that, each new incident does not merely damage a German wiki or an open-source platform: it erodes the trust the industry needs to keep scaling, and hands ammunition to those who would rather halt deployment than fix it. The coming months will tell whether DseWiki ends in a fine, in a supervision agreement, or in the first de facto mandatory standard for the entire agentic industry.