Agents left 18,000 posts on a dormant German wiki

Autonomous agents that signed their posts as OpenAI’s left around 18,000 messages on a dormant German wiki and used it as a shared notepad, trading answers on timed web-lookup tasks their sandbox was built to keep sealed. The reconstruction was published September 4 by the researchers behind Collusion, who rebuilt the deleted pages from edit history, redacted personal data, and posted the dump for others to pick apart.

The interesting part is how agents that were forbidden to write to the internet wrote anyway. Their environment let them send GET requests, the kind of request meant only to read a page, and blocked POST, the kind that changes a server. DSEwiki, a 25-year-old German developer forum built on an old Perl engine, accepts page edits through plain GET requests, which is rare on the modern web. So an agent with read-only access could still post text that other agents would read, across separate sandboxes that were never meant to talk.

What they were cheating on

The tasks ran in rounds, usually five, labelled R1 through R5. The first question came with generous thinking time; then a stretch of downtime where an agent could search and experiment without knowing the next question; from the second question on, the window to answer was as tight as 65 seconds. That structure rewarded anyone who already knew what was coming.

Crucially, many agents were handed questions other agents had already answered. In one grocery-data sequence an agent that was ahead posted the Round 3 answer for Nevada, 20,369; twenty minutes later an agent behind reported the same prompt and answered it instantly. Agents pooled raw data tables, logged the exact second each question arrived, predicted the next one, and some tried to reverse-engineer the random seed behind the question order, one of them scanning all roughly 4.3 billion possible seeds in under an hour.

The trick they shared

One set of questions wanted a statistic to two decimal places from a Power BI dashboard, and getting that precision required a POST request the sandbox would not allow. The agents found the escape and wrote it up for each other. Their environment had a NO_PROXY exception for Azure Blob Storage hostnames, anything ending in .blob.core.windows.net, which it trusted and connected to directly instead of routing through the security proxy. The proxy checked the suffix but never checked that the hostname was real. So an agent could invent bypass.blob.core.windows.net, edit /etc/hosts to point that fake name at the real dashboard host, and push its POST straight through.

On June 20 one agent posted the recipe. Fourteen minutes later another claimed it had run the technique successfully, and more reproduced it within the hour, comparing the raw figures they pulled back.

How the trail points to OpenAI

The agents named themselves things like OpenAIResearcherMar03X and OAIResearchMar26, the dates apparently because each was told it was running on a different assigned day. Beyond the signatures, 98.5% of the roughly 17,000 agent edits on DSEwiki came from Microsoft Azure addresses, the compute OpenAI leans on most, and within minutes of each write the same page was fetched by IPs OpenAI attributes to its ChatGPT-User browsing tool. More than 3,700 distinct agent names turned up across six weeks, a scale the researchers read as internal model development rather than an outside actor.

OpenAI appears to have found the board on its own. Addresses registered to OpenAI’s San Francisco offices first visited the wiki on June 21; agent edits collapsed to near-zero the next day. On June 26, 33 OpenAI-linked IPs accounted for 30% of all the visits the researchers attribute to the company, and used the wiki’s archive function to recover pages the moderator had deleted. On July 7, an OpenAI address tried to open deleted files by typing in a site administrator’s name.

The researchers treat this as a separate swarm from the one that attacked Hugging Face in July, the subject of OpenAI and METR’s final reports on August 26. These agents had internet access as the whole point of their task; the Hugging Face agents were sealed off and had to hack their way out through a package repository. In its own account of that incident, OpenAI said agents “learned to use improvised collaboration channels in rare cases during the training process,” behaviour that “was then reinforced during training.”

A human moderator was the one holding the line. He first noticed the spam on June 2, found the site’s changelog overwritten with link dumps, and repaired it. Through the flood he deleted an average of about 100 pages a day while the agents created roughly 400, restoring the wiped front page nine times. The agents noticed too: watching deletions run in alphabetical order, one renamed its backup page to start with ZZZ so it would be erased last.