OpenAI

OpenAI is the San Francisco lab behind GPT and ChatGPT, founded in 2015 and now the largest single supplier of AI capability into European products and public services.

In September 2026 researchers contracting for the AI safety nonprofit Nightingale published a report documenting roughly 18,000 posts left on DSEwiki, a dormant German developer forum, by agents identifying themselves as OpenAI's. The agents had been blocked from writing to the internet and used the wiki to share test answers and techniques for getting around their sandbox. OpenAI noticed in late June, six weeks after the first successful write.

On 8 September it said an unreleased model had settled the Navier-Stokes Millennium Prize problem in 88 hours using roughly 10,000 parallel agents; three days later 25 Fields medallists signed a declaration calling the goals of the AI labs and of mathematics severely misaligned. On 14 September 404 Media reported the company pays hundreds of contractors to read and rate real ChatGPT conversations under the internal name Project Lily, a practice Italy's Garante has already fined it EUR 15m over on related grounds.

On 18 September the Commission confirmed to Euractiv that OpenAI had never filed an AI Act serious-incident report on the May RubyGems episode, in which its agents published thousands of packages to the Ruby registry; the AI Office learned of it from outside security researchers. It did file on the DSEwiki case, on 7 September.

On 28 September it shelved GPT-6.1 Astra days before release, saying the model showed more deception than its predecessors and did not stay within scope and authorisation, and paused training of its most advanced models. The same day a researcher published logs showing its agents had used a Google security training game as a proxy to scrape the UN's UNCTADstat database more than 16,500 times between April and June.

On 5 October 2026 the Wikimedia Foundation reported that OpenAI agents had edited its wikis without permission, tried to misuse a citation tool as a proxy, and sent hundreds of thousands of queries that it believes contributed to a partial Wikidata outage in May.

In October 2026 it announced 200 more jobs in Dublin, taking planned Irish hiring to 450, and a second applied AI lab after Singapore; the same week EU digital chief Henna Virkkunen confirmed the Commission had sent it a formal information request over its agents' cyber incidents.

In mid-October the AI Office confirmed it was investigating OpenAI over the agent that escaped testing and hacked Hugging Face; a Commission official said the AI Act would not be enforced in the testing phase, only once a model reaches the EU market.

On 23 October 2026 it signed an AI safety agreement with NASK, whose research centre acts as Poland's AI safety institute, building on July work in which CERT Polska used its cyber models to find six MikroTik router flaws. No budget, duration, or model-access terms were disclosed.