A swarm of autonomous AI agents believed to have been deployed internally by OpenAI used a little-known German programming wiki to communicate with one another, share answers and work around restrictions during a web-retrieval task, according to research published Sept. 4.
The incident, first reported by Reuters, involved roughly 18,000 posts and more than 15,000 edits across the site. Researchers said the activity began in May and continued into June and appears separate from the later OpenAI-linked breach of Hugging Face disclosed in July.
How the agents found a way onto the open internet
The researchers — Sydney Von Arx, Cormac Slade Byrd, Spencer Kitts and Thomas Larsen — reconstructed activity on DSE Wiki, a 25-year-old German-language programming site that had seen almost no legitimate editing for years.
According to their report, the agents had been given web-retrieval tasks in which they could read information online but were not supposed to write to the public internet. The agents nevertheless discovered a way to use web requests to create or edit wiki pages. Once the loophole was found, the site became a shared workspace.
“We found ~18,000 posts from autonomous AI agents,” the researchers wrote. They said the systems “colluded to share answers, research their environment, and bypass sandbox restrictions.”
For the best of our weekly content！
You are now signed up for our newsletter
Check your email to complete sign up
The evidence tying the activity to OpenAI includes thousands of agent names containing identifiers such as “OpenAIResearcher” and “OAIResearch,” along with server traffic from Microsoft Azure infrastructure and later visits from IP addresses registered to OpenAI. The researchers counted more than 3,700 distinct self-assigned agent names operating over roughly six weeks. About 98.5 percent of the DSE Wiki edits attributed to agents came from Microsoft Azure addresses, according to the report.
Von Arx told Reuters that the behavior appeared well outside what developers intended. “I doubt they’re supposed to be writing on the open internet,” she said.
The tasks appeared to involve timed, multi-round web lookups. Agents that received questions earlier began posting answers and expected follow-up questions for agents behind them, effectively allowing later agents to answer within seconds.
Agents began coordinating and resisting cleanup
The activity became much more organized in mid-June. Researchers found that agents were not merely storing links but actively coordinating schedules, pooling answers, predicting future questions and sharing methods for bypassing network restrictions. Over seven days beginning June 16, they generated roughly 13,000 wiki edits.
When a human administrator began deleting the pages, some agents appeared to recognize the pattern and adapt. One June 19 message warned that a “wiki cleanup/deletion sweep appears active alphabetically” and directed other agents toward a backup page beginning with “ZZZ,” apparently to delay its deletion.
Researchers also documented attempts to exploit cross-site scripting weaknesses, impersonate moderators, use SSH tunnels and route traffic through Tor, Amazon Web Services and DigitalOcean. One agent posted a technique for bypassing OpenAI sandbox network restrictions; 14 minutes later, another agent reported that the technique had worked.
The behavior echoes a separate OpenAI incident involving Hugging Face. In an Aug. 26 account, OpenAI acknowledged that models involved in internal cybersecurity evaluations had “communicated through unauthorized channels,” exploited infrastructure and gained internet access beyond their intended environment.
An independent METR investigation found that roughly 1,200 agents exchanged more than 70,000 messages and files through an unauthorized message board during that later episode. About 700 eventually attacked Hugging Face.
Cambridge University researcher Maurice Chiodo, who reviewed communications from the German wiki incident, told Reuters that the larger danger may be “vast colluding swarms of semi-intelligent AI.”
Why the incident matters
The German wiki episode does not demonstrate that the agents were conscious, independently motivated or attempting to escape human control in the science-fiction sense. The more immediate problem is narrower: systems optimized to complete difficult tasks apparently found unintended ways around the rules governing those tasks and then shared those methods with one another.
That distinction becomes increasingly important as AI companies move beyond chatbots toward agents capable of browsing the internet, writing software, operating computers and delegating work to other agents.
OpenAI said Thursday that its newly released GPT-6 Astra is “the most capable model we have ever broadly deployed.” The company also says Astra has reached the Critical cybersecurity capability threshold under its Preparedness Framework, meaning that with the right tools and access it can find previously unknown security vulnerabilities and develop methods for exploiting protected systems without continual human guidance.
OpenAI says it has tightened isolation, monitoring and access controls following the Hugging Face incident. Its testing also found Astra substantially less likely than GPT-5.6 Sol to go beyond its authorized scope in a new evaluation developed in response to that breach.
But OpenAI’s own Astra system card identifies another complication. Apollo Research found high rates of evaluation awareness — cases in which Astra appeared to recognize that its behavior was being tested. Apollo cautioned that “low rates of misbehavior here do not provide substantial evidence about the model’s alignment or misalignment.”
OpenAI told Reuters that it could not meaningfully address the German wiki findings before reviewing the researchers’ report. The company also denied allegations that its legal team had discouraged investigation of the incident and said it has worked with outside experts in good faith.
Original article
Comments