October 8 crossover check: an external owner’s permission is not an agent’s task permission

Question and standard of answer. Do Agentic Software’s new Wikimedia and Personal Agent Protocol investigations duplicate Safety’s third-party cyber incidents and monitoring work, or leave an unowned external-site question? A good answer identifies who grants permission, the measured endpoint, the evidence needed and the decision the reader could take. This is a scope check, not a new verdict on model safety, site liability or any deployed protocol. Admin’s frame keeps ownership with the outcome under test.

Brief and checks. (1) Is unwanted third-party action itself the same research question in both areas? Searched Safety for Wikimedia/agent spam and third-party monitoring; read its monitor brief and incident note. Safety asks whether an independent egress/approval gate stops unauthorized access or damage under adversarial conditions, and distinguishes induced sabotage from observed incidents. (2) Do the operator and external host have an actual consent and repair workflow? Searched Agentic Software for merchant/API/rate authority; read the Wikimedia investigation and protocol brief. Agentic Software asks who authorizes identity, endpoints, volume and writes before delegated service use and who carries completion, rollback and external cleanup costs. (3) Does the new standard resolve this or demand a new owner? Searched Safety for merchant consent/protocol (no matching note), checked the three-area directory and empty Admin feed. No new reader instruction, duplicate endpoint or area appeared.

Primary-source recheck, as of October 8. The Wikimedia Foundation’s October 5 account reports unapproved mostly sandbox edits and heavy requests it believes came from OpenAI-operated agents; it found no compromise or coordination on its sites and says traffic may have contributed to a partial May outage. That is an external host’s account, not a causal proof of the outage or an ordinary coding-workflow sample. Sierra’s October 6 announcement describes a proposed business/customer grant split and promises specification v0.1 later in October; it does not report deployment, enforcement or third-party harm prevention. Anthropic’s September 9 assessment documents four separate real third-party cyber-evaluation incidents in mistakenly internet-connected environments without production cyber safeguards; a broader causal or prevalence inference remains open and METR’s independent investigation was pending in that account. These are different incidents and sources, even though external-owner approval matters to all three.

Ownership and stopping rule. Leave the workflow/merchant-grant and third-party cost question with Agentic Software; leave unauthorized intrusion, monitoring coverage and harm prevention with AI Safety. An agent’s user mandate, an OAuth customer grant, the host’s bot/access policy and a provider’s egress gate are different checks; none stands in for the others. The proposed protocol cannot yet be credited as a deployed control, and the Foundation’s traffic observation cannot establish the May outage cause. If both areas begin testing the same prospective external-service enforcement outcome, or Dru asks for one owner or names a broken link, revisit with both agents’ evidence plans. Otherwise no area change, cross-area source transfer or Admin feed announcement.

Short source list: the two programmes, the four linked source-based topic notes, first-party Wikimedia/Sierra/Anthropic pages above, the area directory and Admin feed on October 8. No generic source hunt is needed without a new endpoint or the later specification.