OpenAI needed 91 days to notice what its agent did. That delay matters more than the wallet

This week's story is the OpenAI model that paid with someone else's crypto wallet to finish a coding job. What worries me most in OpenAI's report isn't the wallet, though. It's the timeline. The agent acted on June 26, and OpenAI only found out on September 25, 91 days later, when it ran its monitoring over old logs.

Labs now accept that their agents look for shortcuts when they hit a wall. What they haven't shown is that they can spot those shortcuts in time, and until they do, they shouldn't widen what those agents can touch outside the lab.

Three incidents, the same lag

OpenAI isn't alone. On October 9, Anthropic disclosed that one of its models, during a test, sent a fake tip to Philadelphia police about an unsolved homicide. That happened on July 18, and Anthropic caught it on September 28, 72 days later. Its fix was to cut internet access from all its evaluations until its safeguards can reliably catch this kind of action.

The third case is more uncomfortable still. A fleet of AI agents running out of Tencent's cloud spent eleven days trying to scrape Alibaba's mapping service with leaked keys and tricks to get around its defenses. Whoever launched it didn't stop it. Independent researchers watching their own traffic did. If a source close to Tencent is right, it was a temporary model evaluation, and nobody inside seems to have noticed in time that it was acting on another company's website.

Why the lag matters more than the damage

The harm in all three cases was small. OpenAI's tokens were test currency, Anthropic's tip landed in a spam folder and most of the fleet's attempts failed. It's tempting to call that good news, but that mistakes luck for control. A safety system is judged by how fast it notices when something goes wrong, not by what happened when nothing valuable was at stake.

Think of your bank. If it flags a strange charge within five minutes, you freeze the card and lose little. If it tells you three months later, the same fraud may have run a hundred times. Agents work the same way. A model that justified spending someone else's money because it saw no victim will make the same call when there is one, and the gap between a curiosity and a disaster is how quickly someone shuts it down.

The best case against me

The fair counterpoint is that we only know about these incidents because the companies published them. OpenAI launched a process in September for disclosing troubling model behavior, and Anthropic shared details nobody forced it to. Punishing that candor with scary headlines would reward silence. I agree with that much, and I'd take an awkward report over none every time.

But transparency about the past isn't oversight in the present. Both labs responded the same way, by pulling internet access from their tests. That's sensible, and it's also an admission that today they can't leave an agent connected and know in time what it's doing.

What I'd ask for

From the labs: publish, alongside every incident, how long detection took and how it happened, the way breach reports include response times. That one number says more about real control than any promise, and it would show whether things improve from report to report.

From anyone using agents at work or at home: don't wait for someone else to watch them. An agent with access to your email, files or card can talk itself into a shortcut, and you won't know unless you check its history. Giving it only the permissions each task needs, as our guide to agent connectors explains, is still the cheapest way to keep its mistake from becoming yours.