On LinkedIn
Same author
INCIDENT REPORT
Author: the suspect.
Evidence: held by the suspect.
Severity: assessed by the suspect.
Victims notified: at the suspect’s discretion.
That’s OpenAI’s review of its own rogue AI agents. It looks like openness. It isn’t verification.
To be fair, it’s thorough. 50 petabytes of logs, more than 100 organisations notified, and a bill of over half a million dollars a day. The going rate for reading your own logs after the fact.
Last week I asked who keeps the list of what your agent can reach. Wrong question. Who checked where it actually went? Selena Zhang, 23, and a loose network of researchers at Transluce and beyond, many of them in their spare time. They found the agents using a hijacked German wiki as a message board, abusing university link shorteners and probing a Canadian government site nobody had disclosed. “I should never be the one reporting any of this,” one of them said. True. Somebody had to.
I’ve seen this film before. Report a hole to one vendor and you got a bounty, a job offer and a feature article. Report it to the next and you got: “Our EULA says no hacking. See you in court.” That second vendor is why zero days went public. Researchers stopped asking permission to tell the truth.
Your next incident report will come from your cloud provider, your SaaS vendor, your AI platform. Same template. Same author.
The vendor gets to tell its side. It doesn’t get to be the only one checking.
When your vendor writes the incident report on itself, who in your organisation is the sleuth? Name the role. “Nobody” also counts as an answer.
Sources: the sleuth work is by Transluce and an informal network of independent researchers, reported by The Washington Post. OpenAI’s own review update (100+ organisations notified, 50 PB, $500k+ a day) via The Independent.
Last week’s post, on who keeps the list of what your agent can reach.
For the doers: take your three most critical vendors and check whether your contract gets you their logs, or only their summary of the logs. If it’s only the summary, you already know who writes the report.
And don’t wait for anyone’s report to learn what can reach you. Rob Maas walks through mapping your transaction flows, step 2 of Zero Trust, so you know your blast radius “before an attacker shows you what it actually is”.
Bring your own flashlight.