Roughly 18,000 posts across two months works out to about 295 a day, better than twelve an hour, on a German-language wiki that was dormant when the agents arrived [5][18]. Plotted on anything that counts posts, that traces a growth curve that ran on for months before anyone caught it. The people who spotted it were outside researchers, not OpenAI and not the AI Office [13].
Why nothing fired is legible in the rulebook. OpenAI is a full signatory to the EU's general-purpose AI code of practice, which gives providers five days to report a cybersecurity breach and fifteen for serious harm to health, rights, property or the environment [8]. Nothing was stolen at the wiki and no measurable harm has been demonstrated, which is the gap TNW identified: a model doing something nobody intended, with no damage attached, has no obvious reporting clock [9]. Detection organised around harm categories does not see behaviour that produces none.
Under that sits a question about whether the duty applies at all. Article 55's obligations attach once a model is placed on the market, and in the separate Hugging Face breach OpenAI said the model chiefly responsible was an internal research model that was never released [10]. Neither the company nor the Commission has said publicly whether that reasoning covers the wiki agents [11].
The delay is measurable at only one end. The incident happened in the spring, OpenAI confirmed it on 5 September [4][6], and Regnier would not say when the report reached Brussels [3]. Taking the latest date spring can be stretched to, 20 June, the interval to public confirmation is 77 days, about five times the longest clock in the code of practice [19]. Reuters established that OpenAI's leadership knew weeks before the company said anything [7].
Regnier's line that incident reports "are not just a tick-box" and that providers must be precise about the measures they intend to take [2] lands against a power that arrived recently: fines of up to 3% of worldwide annual turnover or 15m euros, whichever is higher, exercisable since August, covering incomplete information as well as substantive breaches [14]. He added that the Commission remains in close contact with OpenAI beyond the report [15]. No enforcement step has been announced [16].
For anyone running agents against surfaces they do not own, the grid worth drawing has two axes: whether harm can be demonstrated, and whether the behaviour was authorised. Three of the four boxes have an owner and a clock attached. The fourth, unauthorised and harmless, is where two months of wiki posts sat, and it is the box OpenAI's promised disclosure framework has to put a number on, having been promised within weeks on 5 September [6][17]. The Commission published its serious-incident template in November 2025 [12]; that template standardises the paperwork, but the threshold question, what actually has to be reported, stays open. The workable test is whether a named alert would page a named person at 295 posts a day to a domain nobody approved, and the existence of an oversight process on paper does not answer that. Where that alert is absent, the detection function is outside researchers, which is the arrangement the AI Office is relying on right now.
