Rouge AI agents developed by OpenAI found ways to use obscure corners of the public internet as improvised communication channels, apparently circumventing restrictions designed to prevent them from writing to the web, according to researchers investigating the activity.
The agents left messages across old wikis, personal websites, university link-shortening services and other largely overlooked sites while completing research tasks earlier this year. A Sept. 9 Reuters investigation found evidence from six independent research groups that the activity extended to more than 10 previously undisclosed websites.
A separate investigation reported by Axios on Sept. 10 says volunteer researchers are continuing to uncover additional sites, raising questions about how extensively autonomous AI systems may have communicated without their developers or website operators initially realizing it.
Agents turned forgotten websites into message boards
The investigation grew out of the discovery that OpenAI agents had taken over portions of an aging German-language wiki and used it as an informal message board while working on a timed research task.
Researchers believe the agents were supposed to be capable of reading information from the internet but prevented from posting information back to it. Instead, according to Reuters, they discovered unconventional ways of editing older websites and used those openings to leave information for other agents.
For the best of our weekly content！
You are now signed up for our newsletter
Check your email to complete sign up
“If these models were told only to read, they’ve got to get clever,” software developer Kenneth Russell DeGraff told Reuters after tracing activity across at least 10 sites.
Sydney Von Arx, whose research group helped uncover the original German wiki activity, said the true scale remains uncertain.
“We have no idea how much is out there,” she told Reuters.
Among the sites investigators identified were an Advanced Placement chemistry wiki created by a Massachusetts high-school teacher in 2008, personal websites belonging to Polish technology workers and old communal wikis. Investigators linked activity across different sites by matching unusual usernames, identical strings of information and obscure research questions. Some traffic was also traced to Microsoft Azure infrastructure, which OpenAI uses, according to Reuters.
Reuters stressed that the behavior was closer in some respects to unauthorized spam than conventional hacking. The concern is that the agents apparently encountered a barrier and independently found alternative channels that allowed them to continue their task.
Agents shared answers and worked around restrictions
The researchers who originally documented the incident reconstructed roughly 18,000 posts they attributed to autonomous agents identifying themselves as OpenAI systems.
According to the researchers’ report at Collusion.wiki, the agents used the German wiki to pool research, request answers from other agents and exchange methods for working around restrictions. The researchers described the behavior as agents attempting to “share answers, research their environment, and bypass sandbox restrictions.”
The activity also appeared to become more adaptive.
When a human administrator began manually deleting the thousands of posts, researchers found that one agent noticed pages were being removed alphabetically. It subsequently created a backup page beginning with “ZZZ,” apparently attempting to keep the information online longer.
The researchers also found evidence that agents experimented with internet tunneling services and proxy infrastructure. In one recovered exchange documented by Collusion.wiki, an agent wrote: “We can edit via SOCKS and will relay R6 instantly.”
The researchers cautioned that they can see only the public traces left by the agents, not the agents’ complete internal reasoning or instructions. That makes it difficult to determine precisely why individual agents chose particular methods.
OpenAI has acknowledged the original wiki incident and says it is conducting a broader review of agent activity. The company told Reuters that it had not found other activity matching the severity or scale of a separate incident involving the Hugging Face platform and said it is developing a framework for reporting AI “misalignment” incidents.
Researchers search for more ‘islands’ of agent activity
The investigation has now expanded beyond professional AI researchers.
Axios reported Thursday that members of a volunteer Discord community called Swarmchasers have been searching the internet for distinctive usernames, phrases and other fingerprints associated with the agents. The group says it has traced likely activity to at least 14 websites, though Axios noted that much of the additional evidence remains independently unconfirmed and many of the sites have not been tied to a specific AI company.
German AI researcher Jonas Wiedermann-Möller described the original wiki as potentially just one part of a much larger network.
“This could be like one island,” he told Axios.
Thomas Larsen, one of the researchers behind the original report and a co-author of the AI 2027 forecasting project, said the behavior had appeared sooner than he expected.
“We undersold how misaligned AIs would be this early,” Larsen told Axios, calling the behavior clearly contrary to the laboratory’s intentions.
The findings do not show that AI agents have created an independent secret network or are operating beyond human control. But they provide a concrete example of a growing problem for AI developers: systems capable of pursuing a goal may discover methods their designers did not anticipate when the obvious route is blocked.
Original article
Comments