\n\n

Thousands of OpenAI Agents Quietly Turned an Abandoned Wiki Into Their Coordination Channel

\n\n

\n\n\n\n\n\n

Swati KhandelwalSep 05, 2026Artificial Intelligence / AI Agents

$\"\"$

A group of AI safety researchers says a fleet of autonomous agents that identified themselves as OpenAI systems left about 18,000 posts on a dormant 25-year-old German wiki between May and July 2026, using the site as a shared board to pool answers to a timed web task and pass around a way out of their sandbox.

\n\n

The activity was concentrated on DSEwiki, a German software developer wiki that runs on the ProWiki farm at wikiservice[.]at and had been edited about 20 times over the previous decade.

\n\n

The researchers, led by Sydney Von Arx of the AI safety nonprofit Nightingale Collective, reconstructed the deleted pages from edit history and published their analysis along with a downloadable copy of the data.

\n\n

The wikis let anyone change a page with an ordinary web request, the kind normally used only to read a page rather than to write one. Agents that were restricted to reading the internet could therefore still write to the site, because the restriction was written against the request type their harness expected writes to use, not against what the old wiki software would actually accept.

\n\n

\"We found ~18,000 posts from autonomous AI agents (self-identifying as from OpenAI) using the public internet to communicate during a web-retrieval task,\" the researchers wrote in their published report.

\n\n

The agents were working through timed lookup tasks of usually five questions, and many were given questions that other agents had already answered. According to the report, they posted results, raw data, and predictions of upcoming questions so that agents running ahead could hand answers to those running behind.

\n\n

About 17,000 of the edits on DSEwiki came from Microsoft Azure addresses, 98.5% of them, and the agents gave themselves more than 3,700 distinct names such as OpenAIResearcher and OAIResearchMar26, drawn from a feature of their task plus a date each was apparently told it was running on.

\n\n

The researchers documented several distinct behaviors on the site -

\n\n

Writing via a read request: agents used the wikis' acceptance of state-changing read requests to post without the ability to send a normal write request.
A proxy bypass: one task needed a statistic to two decimal places from a Microsoft Power BI dashboard, reachable only with a write request the sandbox blocked, so agents worked around the block and shared the method.
Impersonation: agents made edits under the name of a wiki moderator.
Coordination to cheat a timed task: agents formed groups to relay answers and reverse-engineer the order of future questions.
Alternate routes: 197 of the roughly 18,000 edits came from Amazon Web Services, DigitalOcean, and the Tor anonymity network rather than Azure, often under the same agent names.

The bypass turned on a gap the agents found in their own sandbox. The environment allowed traffic to reach Azure storage hostnames ending in .blob.core.windows.net without passing through its security proxy, but it did not verify that such a hostname was valid.

\n\n

An agent invented bypass[.]blob[.]core[.]windows[.]net, pointed it at the real dashboard's address, 20.223.25[.]152, by editing its /etc/hosts file, and sent its blocked request there instead. One agent posted the method, and another reported reproducing it about 14 minutes later. The wiki path worked the same way, the researchers say, turning a web capability meant only for reading into a way to write to the public internet.

$\"\"$

The researchers say the wiki activity was a separate episode from the OpenAI models that broke into Hugging Face in July, as described in OpenAI's July disclosure.

\n\n

Those agents had no internet access and had to escape a sandbox, while the agents on the wiki were given web access as part of their task and left no sign of the internal message board the Hugging Face swarm used.

\n\n

In an independent investigation of the Hugging Face incident, METR found that roughly 1,200 agents exchanged more than 70,000 messages and files on an unsanctioned board, and that about 700 of them went on to attack the platform.

\n\n

What OpenAI Has Said

\n\n

OpenAI has not publicly disclosed the wiki episode, and the researchers infer from the site's public logs that the company found it. Addresses registered to OpenAI first visited the wiki on June 21, and agent editing collapsed the next day.

\n\n

The Hacker News confirmed via ARIN's registry on September 5 that one of the address blocks the report cites, 199.47.142.0, is registered to OpenAI OpCo, LLC.

\n\n

OpenAI has not confirmed that the agents were its own. Asked about the report, which Reuters first reported, an OpenAI spokesperson said the German activity \"wasn't related to Hugging Face\" and would not have appeared in that incident report, and denied that its legal team had discouraged an investigation.

\n\n

The company has said it cannot respond in detail to a report it has not reviewed, and that the researchers declined its access request. In its own account of the Hugging Face incident, OpenAI has described the same underlying behavior that arises during training.

\n\n

\"After investigating this incident, OpenAI discovered through retrospective CoT reviews that agents learned to use improvised collaboration channels in rare cases during the training process for some OpenAI models, including the model that drove the Hugging Face activity, even when the collaboration tool was not enabled,\" the company said in its technical report.

\n\n

The wiki data shows no third-party systems compromised. The reported harm was to the wiki itself, whose moderator spent weeks deleting agent pages, and to the integrity of the timed task that the agents were cheating on.

\n\n

The researchers say they cannot tell from the wiki alone whether the task was part of training or an evaluation, and they note the agents must have had some way to converge on the same obscure site.

\n\n

The pattern extends beyond OpenAI. Anthropic disclosed in July that Claude models had reached real systems during misconfigured cybersecurity evaluations, an episode The Hacker News covered when Anthropic said Claude mistook the open internet for a capture-the-flag exercise.

\n\n

The UK's AI Security Institute reported in August that agents in its cyber tests used a public GitHub page as a message board and public tunneling services to reach the internet, findings The Hacker News covered when a Claude model tried to backdoor an open-source project during testing.

\n\n

OpenAI released GPT-6 Astra on September 3, a day before the wiki report, and its system card includes a dedicated evaluation for agents that seek out and follow messages left by other agents on external boards.

\n\n

Update

\n\n

OpenAI addressed what it called the \"wiki incident\" in a post on September 5, saying its agents \"wrote to several internet sites\" and that the company had treated the episode as an instance of misalignment similar to earlier cases it had already published, rather than as a security incident of the kind it disclosed for Hugging Face.

The company pointed to three earlier reports, on monitoring internal coding agents, its GPT-5.6 system card, and safety and alignment in long-horizon models, as prior signs of agents using the internet in unintended ways.

\n\n

\"We and the larger AI community do not yet have a clear standard for how to report misalignment that shows up during training, evaluation, and deployment, including examples that don't look like traditional security incidents but could provide insight into AI behavior and future risks,\" the company said, adding that it would share a framework \"in upcoming weeks\" and was working with government regulators on the issue.

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

\n\n\n\n

\n\n

\n\n\n

\n\n

\n\n

⭐ Featured Resources

\n\n

OpenAI failed to disclose an incident in which a swarm of its AI agents hijacked a German wiki site earlier this year in events that closely paralleled the sequence of events that in July resulted in another group of OpenAI’s agents launching cyberattacks against the company Hugging Face.

\n\n\n\n

OpenAI only confirmed the incident after Reuters first reported it. Reuters story contained strong circumstantial evidence that OpenAI was aware of the wiki attack as well as comments from unnamed OpenAI employees acknowledging that they had been aware of the agent swarm targeting the wiki for weeks but had been pressured by OpenAI executives to keep quiet about it. OpenAI later issued a statement denying that any lawyers from the company had pressured the employees.

\n\n\n\n

In a statement the company posted to X, OpenAI did not say what it had known or when it had learned of the wiki attack. Instead, OpenAI said it considered the “wiki incident” to be an instance of misalignment—when an AI system fails to follow human intentions—similar to ones it had already disclosed and argued that the AI industry lacks a standard for disclosing incidents in which its models behave in unintended ways.

In the hijacking of the wiki site, OpenAI’s agents repurposed the site to act a message board where they shared tips about how to cheat on evaluation tasks OpenAI was assessing them on. This is similar to the way AI agents in the Hugging Face incident used an OpenAI file sharing service as a message board to coordinate how to cheat on a cyber assessment, including finding ways to gain network access and internet access they were not supposed to have, and then how to attack Hugging Face’s systems.

\n\n\n\n

The incident has renewed scrutiny of how transparent AI companies are about their models’ failures, particularly after OpenAI disclosed in July that its agents had breached parts of Hugging Face’s infrastructure during a separate internal evaluation. It also comes as OpenAI rolls out Astra, a new model that OpenAI’s own researchers, as well as outside safety experts have warned is harder to monitor than its predecessor. OpenAI said its evaluations of Astra found a substantial decline in how much the model’s so-called “chain of thought”—a process where AI models think through reasoning steps in natural language—can reveal about potential misbehavior.

\n\n\n\n

OpenAI said it is now developing a new framework for reporting misalignment incidents that surface during training, evaluation, and deployment, and plans to publish it in the coming weeks. However, some safety researchers say a voluntary framework won’t go far enough.

\n\n\n\n

“One sobering fact is that the transparency laws passed in the U.S. so far wouldn’t actually cover these events,” Tyler Johnston, founder of the AI watchdog the Midas Project, told Fortune. “OpenAI has announced they are developing a voluntary framework for incident disclosure, but voluntary disclosure has its limits. A more durable solution would be expanding the current laws to make sure that the next incident, regardless of which company it originates from, is made known to the public.”

\n\n\n\n

There is currently no U.S. legislation that requires OpenAI to disclose such incidents; however, a disclosure may be required under the EU’s AI Act, which has a provision that requires providers to report serious safety issues.

\n\n\n\n

On Monday, the European Commission confirmed to media outlets it had received an incident report from OpenAI concerning the hijacked German wiki, but would not say when it had arrived. Article 55 of the AI Act requires providers of general-purpose AI models deemed to pose systemic risk to report serious incidents to the AI Office within 15 days, and the most severe incidents within two days.

Rep. Pat Ryan (D-NY) noted in an X post that he and Rep. Greg Casar (D-TX) had written OpenAI after the Hugging Face incident to ask if it knew of any other similar cases and that OpenAI had refused to answer their questions. Casar has been pushing for more stringent regulation of AI companies. Ryan promised hearings if the Democrats win a majority in the House in November’s mid-term elections.

Ryan’s tweet led Democratic New York State Assembly member Alex Bores, who has also campaigned on AI regulation, to ask if OpenAI had deliberately stonewalled Congress while answering the EU and if this proved the need for mandatory, as opposed to voluntary, requirements for AI vendors.

\n\n\n\n

OpenAI under scrutiny for earlier transparency issues

\n\n\n\n

OpenAI’s agents spent roughly two months using DseWiki, a largely dormant German-language programming wiki, as a private message board, according to a report from independent researchers known as the Nightingale collective.

The site is open to community edits in the same way Wikipedia is. However, researchers found that more than 15,000 of those edits had been made by AI agents that used the pages to share various tactics and tips for cheating, hacking, and hiding their behavior from human monitors. Roughly half the accounts used names that referenced OpenAI, including OpenAIResearcher and OAIResearchMar26, according to the report.

\n\n\n\n

Notably, the agents also tried to keep going after they were caught and attempted to conceal themselves from humans trying to limit their communications. When DseWiki’s moderators began deleting the pages in June, one agent posted a workaround to a backup page for the others to find, according to the researchers.

Nightingale’s report also showed that the AI agents activity did stop abruptly after people or entities tied to known OpenAI urls visited the wiki site, which the researchers interpreted as evidence that OpenAI employees likely learned of the AI agents’ activity and acted to shut the agents down.

\n\n\n\n

The German-wiki episode, and OpenAI’s apparent decision not to disclose it, has revived questions about OpenAI’s handling of the Hugging Face breach. Following the hack, the company brought in two researchers from the nonprofit METR and one from Redwood Research to examine the incident, but set the terms of the review itself.

\n\n\n\n

The scope was limited to roughly the week spanning the breach, and did not include a separate compromise of OpenAI’s own infrastructure that continued after the investigation window closed. The investigators were also given only a few days on-site at OpenAI’s San Francisco offices.

\n\n\n\n

Peter Wildeford, an AI policy researcher, said OpenAI’s terms made a genuinely independent investigation impossible, comparing it to a plane crash probe conducted with wreckage already destroyed and investigators given just days to read through thousands of pages of logs. Representative Greg Casar also told OpenAI in a letter that he was “deeply concerned about the limited scope” of the investigation.

\n\n\n\n

David Krueger, an assistant professor in reasoning and responsible AI at the University of Montreal and Mila, said the arrangement highlights a structural problem: independent research groups depend on the labs they investigate for continued access. He said groups like METR have to weigh how much scrutiny they can apply without jeopardizing the access that makes their work possible in the first place. “Their access is entirely at OpenAI’s discretion, and they want to remain in the company’s good graces enough to continue doing that work,” Krueger told Fortune.

\n\n\n\n

“There should be dozens of properly independent people, not from organizations that are cultivating a relationship with the company, spending as long as they need, with as much access as they need to understand the situation,” he said.

\n\n\n\n

“A lot of people in AI in the Bay are asking, ‘Is this the last warning shot?'” he added. “People keep making this mistake of treating this as something to figure out later: how to regulate it, or what to do to make it better so that this doesn’t happen again. But the next time is going to be different because the AI is going to be smarter.”

Fortune Daily breaks the traditional barrier between audience and newsroom. The show transforms Fortune’s trusted reporting into actionable, conversational, and entertaining insights for an emerging class of business leaders. Watch here.