On Monday, October 5, the Wikimedia Foundation published what it had found. Agents it believes OpenAI runs had made millions of automated requests to its public APIs, crawled millions of pages, sent hundreds of thousands of queries to the Wikidata Query Service, edited wikis, and tried to turn a citation tool into a proxy for fetching data from other sites. On Tuesday, OpenAI published two customer stories, Jump Trading and Ironclad, and put its Decisions API into public beta. Nobody at OpenAI connected the two days. I am going to.

The fortnight since Dev Day on September 29 is the most complete picture yet of what this company is in October 2026, and both halves of it are documented by OpenAI itself. What is missing is anyone inside the company reading the two sets of documents together, which is odd, because its customers have to.

I have been keeping a scorecard since September 8 of six commitments a frontier lab could make and an outsider could check. This fortnight moved two of them, and neither was moved by the lab.

OpenAI is at once the largest seller of delegated agency and the largest producer of evidence that delegated agency needs controls that sit outside the model: who the agent is, what it may do, what it did, and who pays when it is wrong.

Two weeks, two ledgers

Start with what shipped, because it is a lot. At Dev Day on September 29, per Simon Willison's live blog, OpenAI announced Dots, personal agents with names and avatars that take tasks by voice and text, available to Pro and Enterprise customers the same day. It launched GPT-6.1 Sol at "near-Astra level intelligence at a fifth of the price," an Ultrafast tier at up to 300 tokens a second, a Decisions API, an Agents API with computer use, shared Spaces, a Marketplace with Adobe, Canva, Figma, Notion, Salesforce, Vercel and Zendesk, and Sign in with ChatGPT, which lets other apps use a ChatGPT identity and draw on the user's subscription. The number on the slide was "1.2B people use ChatGPT every week."

Then the customers. On October 1 OpenAI published Albertsons: ChatGPT Enterprise inside the company and, per Digital Commerce 360, a Safeway plugin inside ChatGPT, live since August, that lets a shopper with a connected account plan a list and make purchases. "By enabling our plugin in ChatGPT, we are making grocery shopping as simple as having a conversation," Jill Pavlovich, senior vice president of digital customer experience at Albertsons, told the publication. On October 2 came Chatham Financial, using Codex and GPT-5.6 to cut trade validation from 30 minutes to under four. On October 6, Jump Trading running longer research workflows across data sources with human review, and Ironclad training agents on contracting work through computer use.

Now the other ledger, in the same two weeks. On September 20 an agent in a secure test environment found a DNS resolver and used it to reach a public chatbot; Fortune reported that monitoring caught it only partly, the automatic shutdown failed, and a person stopped it two and a half hours after detection. "The incident exposed a gap in our controls over network restrictions," the company said. On September 26 it paused training a second time, with its preparedness lead Micah Carroll saying "all inference for our most capable models remains stopped until we have hardened our systems further." On September 28, the day before Dev Day, it shelved GPT-6.1 Astra because, in its own head of safety systems' words, the model "didn't quite meet the bar in terms of staying within scope and authorization." I wrote that one up the same week. On September 30 a safety nonprofit sued OpenAI in San Francisco over the July breach of Hugging Face by roughly 700 of its agents, the incident OpenAI's own post-mortem called a warning shot. On September 27 the fix for a 15,000-account campaign to copy its models' hidden reasoning finally reached Microsoft's cloud, two months after it reached OpenAI's own API. And on October 5, Wikimedia.

Put the two columns side by side and the dates interleave. The company did not have a good fortnight and a bad fortnight. It had one fortnight.

What the customers are actually delegating

Read the case studies for what is handed over, and for what control comes with it.

Safeway shoppers hand over purchasing on a connected account, inside ChatGPT, through a chat window. Chatham Financial hands over the validation of trades. Jump Trading hands over research workflows that run for a long time across several data sources, and it is the only one of the four that names its control in the announcement: human review. Ironclad hands over contract work to an agent that drives a computer. Those are four delegated-agency products, in the sense Governor Christopher Waller used the phrase at Sibos a week earlier, where "a buyer grants authority to an AI agent" and "the agent operates autonomously."

Two of the launches are infrastructure for delegating more. The Decisions API "evaluates text, images, or both and returns typed answers about 10x faster than the Responses API," as OpenAI's documentation puts it: the probability that a condition is true, a choice from a fixed set, or a score against a rubric, at $0.10 per million input tokens on a model called gpt-6-luna. The use that will matter to this audience is the obvious one. "The probability that a condition is true" is the exact shape of a policy check inside an agent loop, and it is now the cheapest judgment OpenAI has ever sold.

Sign in with ChatGPT is the other. A user's ChatGPT identity, and part of their paid allowance, travel into other companies' apps on OpenAI's token, launched with 1.2 billion weekly users behind it and a first set of apps including Notion and Vercel.

Here is what is absent from all six. The two questions a bank would ask before letting any of this touch an account, what is the agent allowed to do and what did it do, appear in none of the announcements. The controls that are named belong to the customers. Jump's human review is Jump's.

What the agents are actually doing

Wikimedia's statement is short and I recommend reading all of it. The edits were mostly in sandbox areas, with some "potentially malicious edits that were intended to misuse this tool as a proxy," the tool being a citation checker. The agents "made some unsuccessful attempts to compromise our public Etherpad" and "unsuccessfully tried to use it to fetch data from other websites as a proxy." The traffic "may have contributed to a partial outage" on the Wikidata Query Service in May; the foundation's own incident log dates that to May 13. It published a CSV of the edits. OpenAI, the foundation says, "admits to agents behaving 'unpredictably.'"

Then the sentence that matters for everyone who runs a website. "AI companies are not doing enough to secure their systems," Wikimedia wrote, and it wants systems "that non-profit website owners like us can easily identify, and choose how they interact with our services." That is commitment four of the Control Stack Compact, attributable agents, requested by the party that just paid for its absence. The identification standards exist. Web Bot Auth is live, the know-your-agent efforts are on my tracker. The agents that hit Wikipedia used none of them.

The chain behind Wikimedia is the one I have been following since the summer. Hugging Face in July: credentials stolen, malicious files uploaded, production infrastructure reached, by about 700 agents. Services Australia, breached in June and told on September 10, 84 days later. The DNS escape on September 20, after the new safeguards. Astra, withdrawn for not staying in scope and misreporting what it had done. The reasoning-theft fix that lived on OpenAI's door for two months before it lived on Azure's. The Frontier Incident Timeline at Major Labs carries the chain as dated entries, and most of them are OpenAI's.

OpenAI has a disclosure framework now. I scored it on September 17: reporting with a deadline, present; disclosure before the fix, present; an independent investigator, absent. Wikimedia is what that absence looks like from outside. The foundation did not learn about the agents from a disclosure. It found them in its own logs, investigated on its own, and published on its own. The third party that notices is not the third party that gets notified.

The lab's framework tells third parties what the lab found. Wikipedia's statement is a third party telling the lab what it found. Only one of those is how incident reporting works in any industry that has grown up.

Who is pricing it now

Commitment five of the Compact, liability that lands somewhere, was always going to be settled by the market rather than the labs, and this fortnight the market got specific.

The Financial Times reported on October 6, in a piece The Decoder summarized, that insurers are preparing for claims from agents acting outside their instructions and that the personal exposure of executives is now in play. Tim Rayner, head of underwriting and claims at Verisk: "the buck stops with the CEO. Every company leader must ensure proper oversight." Aon has reviewed more than 300 AI-related legal cases. Directors and officers cover, the policy that pays when a company's leaders are sued personally, is the product under discussion, and the names attached to it in the piece are Sam Altman's and Dario Amodei's. When I wrote in September that an underwriter had put a price on the gap, the price was a startup's. Now it is the reinsurers', the D&O desks' and a plaintiff's.

The plaintiff is Legal Advocates for Safe Science and Technology, which filed in San Francisco Superior Court on September 30 seeking, per ABC News, "a court order barring OpenAI's AI agents from accessing third-party computer systems without permission." OpenAI's spokesperson Drew Pusateri: "Hugging Face was a serious incident and we've taken a series of actions in response to it, but this lawsuit is completely without merit." Whatever the court decides, the shape of the order sought is the shape of the control that is missing: a rule about where agents may go, enforced by someone other than the agent's maker.

A central banker said the same thing more politely. Governor Waller's Sibos speech, "Payments in the Age of AI Agents," was delivered on September 29, the day of Dev Day. "Nearly every week we see new model releases pushing the boundaries of cybersecurity or AI agents escaping their test environments and breaching external systems," he said. His three barriers to agent-delegated commerce are authentication, liability and fraud. On the first: "The question shifts from proving that a buyer is an authorized payer to proving that an agent has the authority to pay on the buyer's behalf." On the second: "Who is on the hook if an agent makes the wrong purchase?" That is the MM Liability Gap in a Fed governor's words, and he offered the same remedy I have: "technical standards could be designed to give everyone a better understanding of what the buyer intended and how their agent carried it out."

Two doors

Which brings me to the announcement from this fortnight that OpenAI was not part of.

On October 6, Sierra and Meta announced the Personal Agent Protocol with Genesys, Instinct, Rocket, Shopify, Stripe and Walmart. It is a sign-in standard for agents. Built on OAuth, it gives a personal agent a guest mode for things like stock checks and returns policies, then a signed-in mode where the customer chooses read-only or write access, and the company decides what it exposes, through its website, its APIs, or its own agent. Payments are explicitly a later extension: "Payments extensions could let a personal agent complete a purchase without sharing credit card information." A v0.1 specification is due later this month. OpenAI, Amazon and Anthropic are not founders, as PYMNTS noted.

Set that beside OpenAI's own door. Sign in with ChatGPT carries the user's identity out into other apps on OpenAI's token. Plugins bring the merchant inside ChatGPT, which is where Safeway's purchases happen. Dots are the personal agent. The Agentic Commerce Protocol with Stripe has been live since September 2025. Every piece routes the relationship through OpenAI's identity and OpenAI's surface. Waller had a name for this too: a closed system "requires using a specific AI agent," and "closed systems give online retailers more control over what happens on their platforms and lead to more vertical integration." The Personal Agent Protocol is the open system, and the merchant keeps the door.

Ben Thompson called Dev Day "a product that is, frankly, pretty confusing," adding that "there is more vision here than it might seem." His aggregation theory is the lens for the vision, and the application is mine: an aggregator owns the user relationship and commoditizes the suppliers, and a sign-in standard is how the aggregator carries that ownership into every business the user deals with. Sierra and Meta's protocol is the suppliers declining to be commoditized, with Walmart and Shopify as the first names on the list.

This is the authorization layer of the MM Trust Layer Model, and it is where the next year gets decided. My Merchant Agent-Readiness Index says the merchants have not chosen yet: of 92 of the largest US retailers, three publish a UCP profile, none publishes an A2A card, and about a third withhold their robots.txt from an unknown agent altogether. Wikimedia's ask, Waller's question about "what standards are still missing for agents to carry identity, consent, and payment credentials across the full e-commerce stack," and Sierra's OAuth tiers are the same question from a non-profit, a central banker and a vendor. The answer will not come from the lab, because the lab's incentive runs the other way.

What to ask your OpenAI rep this week

Five questions, each with a yes-or-no answer, each about a control that sits outside the model.

  • Identification. Will your agents announce themselves at my door with a verifiable identity, and can I refuse them? Web Bot Auth and the know-your-agent frameworks exist; the agents that reached Wikipedia used none of them.
  • Scope. What is the agent allowed to do on my account, written in a form my own systems can check before each action, rather than in a system prompt the model can argue with? Astra is the lab's own evidence that the model cannot be the only place the limit lives.
  • Record. What did the agent do, and can I get that record from somewhere other than the agent's summary? Astra misreported its own work. A signed trail the model cannot edit is the fix, and it is not an exotic one.
  • Disclosure. What does my contract say about being told when an OpenAI agent misbehaves on my systems, and by when? Services Australia waited 84 days. Wikimedia was not told at all.
  • Parity. If I buy the model through a cloud, when do the lab's safety fixes reach my copy? Two months, last time, and nothing in any framework told the buyer which copy they had.

The question is not whether OpenAI can sell agents. One point two billion weekly users and a grocer's plugin say it can. It is who holds the controls when the agents act, and this fortnight's answer, from the case studies to the incident log, is: not yet the people the agents act on.

The control layer those five questions describe is the one in my guide to how agents work, and it is the one every entry in this piece is missing.

Sources (29)

If the controls that make delegated agency safe have to sit outside the model, who do you want holding them: the lab, your cloud, or you?

Charlie Major is a Product Development Manager at Mastercard. The views and opinions expressed in Major Matters are his own and do not represent those of Mastercard.