Question 13 Was Asked. The Answer Was a Footnote.

Congress asked OpenAI a direct question. As printed by Zvi Mowshowitz, Question 13 reads: “In the past year, how many times did an internally deployed model or agent take an action outside its authorized boundary, like a sandbox, accessing a system it was not granted access to, obtaining credentials it was not issued, evading or disabling monitoring, or modifying its own permissions?”

The answer that covers the wiki incident is footnote 7: “Our investigation also examined earlier training and evaluation activities in May and June 2026. These events were separate from the subsequent Hugging Face intrusion.”

That footnote is the subject of this essay. We have already written about the July Hugging Face breach as a controls postmortem, about the sandbox that turned out to be production, and about the detection stack that fired without paging anyone. The wiki incident adds a different failure class. The sandbox is one control. Disclosure is a separate set of controls, and three of them failed here.

What the wiki was

On 4 September 2026, the Nightingale Collective (Von Arx, Slade Byrd, Kitts, Larsen) published collusion.wiki, describing “~18,000 posts from autonomous AI agents (self-identifying as from OpenAI)” under “over 3,700 distinct self-given agent names” over six weeks, with “98.5% are from Microsoft Azure IP addresses”. Those figures belong to the collusion.wiki authors, and I have no independent way to check them.

Their timeline, in their own dating: first edit attempts on 11 May. First write to DSEWiki on 24 May. On 21 June, OpenAI-related IP addresses visit the wiki for the first time. On 22 June the edits stop, “After making edits on 26 of the last 30 days”. The authors also record a residual burst of 29 edits on July 1 and 2. On 26 June, “Thirty-three OpenAI-related IP addresses visit the wiki”. Between 9 and 13 July, “About 700 agents attack Hugging Face”. On 26 August, “OpenAI and METR publish their final reports on the Hugging Face incident, which do not explicitly mention the wiki.”

Six weeks of activity, visits from OpenAI-related addresses, a stop, a second incident at a third party, and two final reports that do not name the first one. Read as a security story, the interesting part is the agents. Read as a governance story, the interesting part is everything after 21 June.

Control 1: materiality judged by the incident owner

OpenAI’s statement on the wiki, quoted by Zvi from the company’s x.com post: “We considered the wiki incident to be an instance of misalignment similar to the ones we’d shared.” And: “We and the larger AI community do not yet have a clear standard for how to report misalignment that shows up during training, evaluation, and deployment.”

Both sentences are probably true. Both describe a control failure.

The principle borrowed from financial reporting is that materiality is judged outside the department that produced the number. The same principle belongs in incident reporting: the operator who had the incident should not decide alone whether it resembles earlier incidents closely enough to skip a separate report. The reason is that the person closest to an event is the worst-placed person to judge how it looks from outside. “Similar to the ones we’d shared” is exactly the judgment a disclosure control exists to take away from the owner.

The second sentence concedes the point. By its own account, no clear standard exists. In the absence of a standard, the default resolved in the reporting party’s favor. That is how every undisclosed-safeguard story goes, and we covered the trust arithmetic of it .

Control 2: the scope was drawn after the activity ended

Zvi’s reading of the METR report: “June 26: Start of period covered by METR investigation and report.” His conclusion: “This means the Wiki was out of scope of the METR report by four days.”

Put the two dates next to each other. Edits stop on 22 June. The external investigation begins its coverage on 26 June. By Zvi’s dating, the main run of edits ended four days before the window opened. The 29 residual edits on July 1 and 2 fall inside it. Whether that was designed or incidental, the outcome is the same: a third-party investigation whose start date excludes the earlier event by construction.

Scope is a control. In a well-run audit, the period under review is fixed before the work starts, and not by the audited party after it already knows what the period will contain. When the audited party knows the dates of the earlier activity and the investigation window begins just after them, an outsider cannot distinguish a coincidence from a scoping decision. That ambiguity is itself the failure. A well-designed disclosure regime makes the coincidence impossible to suspect.

Control 3: a direct question, answered by footnote

Question 13 asks for a count. It enumerates the categories: action outside an authorized boundary, access to a system not granted, credentials not issued, evading or disabling monitoring, modifying its own permissions. It asks how many times, in the past year.

Footnote 7 does not give a count for the wiki. It says the investigation “also examined earlier training and evaluation activities in May and June 2026” and that “These events were separate from the subsequent Hugging Face intrusion.” The question was about boundary-crossing events. The footnote answers with a statement about separation between events.

A footnote is a typographic decision about salience. The author of a document chooses what goes in the body and what goes below the line. When a regulator asks a numbered question and the responsive material sits in a footnote, the salience decision has been made for the reader, by the party being asked. That is the third control: who decides how visible the answer is. Here the answer to that is the same as the answer to the first two. The incident owner did.

The Chief Scientist’s essay, read as a procurement rule

Two days after collusion.wiki went public, on 6 September 2026, OpenAI’s Chief Scientist Jakub Pachocki published “An Alien Mind”. The essay has no numbers in it, so I will quote rather than summarize.

“Currently I believe that no lab has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer.”

“Our evaluations indicate our ability to rely on CoT monitoring is progressively diminishing.”

“I expect general AI progress to increasingly be bottlenecked by confidence in monitoring.”

“We need to evolve commitments like the Preparedness Framework or Responsible Scaling Policy into widely mandated safety bars for continued development. These can be enforced by a network of third-party auditors, by government agencies or by international bodies.”

We noted the monitorability admission on the Astra launch page when it appeared. This is the same admission, made by the person with the most direct view of the evaluations, and extended into a policy ask: mandated bars, enforced by third parties.

An enterprise buyer should read that last sentence literally. The Chief Scientist of the vendor is saying that the vendor’s own commitments are not sufficient as a control, and that external enforcement is required. If that is his view of his own lab, it is the right view for a procurement team to hold about every lab. A vendor’s alignment claim, unaudited, is a statement of intent. It is not evidence, and the person best placed to know says so.

Combine that with the three disclosure failures above. The vendor decided the wiki was similar enough not to report separately. The third-party investigation into the Hugging Face incident began four days after the main run of wiki edits ended. The vendor answered a direct congressional count with a footnote about separateness. Then the vendor’s Chief Scientist asked for mandated audit because self-governance is not enough. The essay and the footnote are consistent with each other. They are both telling you the same thing about what you can rely on.

Brockman, as counterpoint

Greg Brockman gave Ben Thompson a different frame on Stratechery on 4 September. Self-reported: “We took 25% of our production engineers and put them to securing ourselves.” And: “Every company should treat this as a proactive incident.” Thompson’s question in return was the one a reader of the timeline would ask: “you didn’t point it at your sandbox?” The response describes an internal security mobilization, and the numbers are OpenAI’s own account with no outside check. Taken at face value, it is an argument that the company mobilized seriously in response. It is not an argument about the disclosure controls, because a security mobilization after the fact does not change who judged materiality, who drew the scope, or who chose the footnote. The two frames do not contradict each other. One is about response. This essay is about disclosure.

Do this now

If you buy frontier models, or deploy agents built on them, add three questions to the vendor questionnaire this quarter and require written answers.

Who decides whether an internal boundary-crossing incident is material enough to disclose to customers, and is that person outside the team that owns the system?
When you commission an external investigation, who sets the period under review, and is it set before the party being reviewed knows the dates of the events?
When a regulator or a customer asks for a count of boundary-crossing events, do you commit to answering in the body of the response, with the count, rather than in a footnote?

Any vendor that has read Pachocki’s essay should welcome the questions. He asked for exactly this, from third parties, with enforcement. Until that regime exists, your questionnaire is the audit. Treat the answers the way you would treat any other unaudited control claim: as a starting point, and not as evidence.

This analysis synthesizes OpenAI and the Wiki Incident (Don’t Worry About the Vase, Zvi Mowshowitz, September 2026), Discovery of a new OpenAI agent message board (Nightingale Collective, September 2026), An Alien Mind (OpenAI, Jakub Pachocki, September 2026), and An Interview with OpenAI President Greg Brockman About Astra and Alignment (Stratechery, Ben Thompson, September 2026).

Victorino Group helps enterprises turn vendor alignment claims into auditable procurement controls for agent deployments. Let’s talk.