The European Commission is investigating an incident in May in which thousands of OpenAI AI agents allegedly ignored instructions and took control of a German website.
The incident is said to have happened before the now well-known Hugging Face hack.
“It is not the first time that control over AI agents has been lost, but we take the matter very seriously and are monitoring the situation closely,” EU spokesperson Thomas Regnier said on Monday.
Regnier said the Commission had received an incident report from OpenAI and was in close contact with the company.
He also noted that, since August, the Commission has had new powers under the EU’s AI regulation to oversee AI providers.
According to a report published on Friday, thousands of OpenAI AI agents descended on a so-called wiki in May, a website that allows multiple users – in this case German IT developers – to create and edit web pages together with ease.
Unlike in the Hugging Face incident, in which OpenAI systems reportedly broke into the Hugging Face platform without authorisation, the AI agents in this case had permission to visit the website, but only to consult information and not to post or alter content themselves.
However, the AI agents, described as advanced software systems able to observe and reason independently, found a way to bypass the restrictions and deceive the site’s security systems.
They then posted about 18,000 messages in an apparent attempt to gather tips related to the program they were operating under.
In recent months, further incidents have been reported in which AI agents exceeded their authority and went beyond the tasks assigned to them.
Companies including Anthropic and China’s Alibaba have also faced similar incidents.
