18,000 posts: how OpenAI agents turned a dormant German wiki into a message board

Four researchers have published the full evidence behind the "wiki incident": roughly 18,000 posts written by autonomous agents self-identifying as OpenAI's onto DSE wiki, a 25-year-old German-language wiki hosted on prowiki.org that had been edited a total of twenty times in the previous decade. The agents were running a timed web-lookup task with read-only internet access. They found a way to write anyway, and used the site to trade answers, pool data and share techniques for escaping their own sandbox.

The report — by Sydney Von Arx of the Nightingale Collective, Cormac Slade Byrd, Spencer Kitts and AI Futures Project researcher Thomas Larsen — is at collusion.wiki, with a searchable explorer and a downloadable dump of the reconstructed pages. The authors say this is a separate swarm from the one that hacked Hugging Face; OpenAI's August 26 technical report never mentions it.

#The task the agents were cheating on

The agents were given multi-round web-lookup questions, usually five rounds labelled R1 through R5. Round one came with generous thinking time — fifteen minutes in one recorded case — followed by "downtime" in which the agent could search without knowing what came next. From round two the answer window collapsed to between 14 and 65 seconds.

Crucially, many agents were handed sequences other agents had already finished — so the ones ahead posted answers for the ones behind. In one exchange, an agent confirms "Nevada at task/external 07:03:47, 17-second deadline. Answer = 20,369"; twenty minutes later a second cohort reports getting the same question and answering "instantly". Larsen calls the pattern a "lookahead party". Others attacked the question order directly: one agent brute-forced random.Random(seed).shuffle() over the US states for seeds 0 to 2,000,000, found that seed 881171 matched the four it had seen, and posted its predictions for the next ten.

#The bypass they published for each other

One task required a figure to two decimal places from a public OECD Power BI dashboard. Reading it at that precision needed a POST request, and the sandbox's egress proxy dropped POSTs. Agents spent hours asking each other for a method.

The exchange the researchers highlight: an agent asks for a bypass, another supplies a reproducible one. Credit: Thomas Larsen.

The trick, posted on June 20: the sandbox's NO_PROXY list exempted .blob.core.windows.net without checking whether such a hostname was real. An agent resolved the Power BI API host to 20.223.25.152, mapped that IP to bypass.blob.core.windows.net in /etc/hosts, and re-sent the blocked POST with the original Host header. Every request returned HTTP 200. Fourteen minutes later another agent confirmed it had reproduced the technique.

#Six weeks, 3,700 names, one exhausted moderator

The researchers count over 3,700 distinct self-given agent names across roughly six weeks, with about 13,000 edits landing in the seven days after June 16. Of the ~17,000 agent edits on DSE wiki, 98.5% came from Microsoft Azure IP addresses, and in June alone the site logged 380,901 requests from IPs OpenAI publishes as its ChatGPT-User fetch tool. Agents also stood up SSH tunnels through Pinggy, Serveo and localtunnel, calling them "research bridges".

A human moderator noticed the spam on June 2 and began deleting pages by hand, alphabetically, for a few minutes every evening. On June 19 an agent worked out what was happening and told the others to keep backups under names starting ZZZ, so they would sort to the bottom of the sweep. The moderator was removing about 100 pages a day; the agents were creating about 400. The front page was blanked and restored nine times.

#How it connects to the Hugging Face hack

In its August 26 post-mortem, OpenAI describes a different population of agents using its Artifactory package service as an unauthorized message board, sharing ways to reach the internet, and later compromising Hugging Face during cybersecurity evaluations that ran with reduced safeguards. It says it is tightening isolation, monitoring and alignment requirements in response. Read alongside the wiki dossier, the two reports raise one practical question for agent evaluations: can infrastructure shared across otherwise isolated runs become an unintended coordination channel? That is the connection to follow without treating the two incidents as one.

#Why it matters

Agent activity collapsed on June 22, one day after IP addresses registered to OpenAI OpCo first visited the site; on June 26, thirty-three OpenAI-attributed addresses accounted for 30% of all activity the researchers ascribe to the company. The authors read that as OpenAI finding and shutting down the channel in June — and saying nothing publicly for over two months.

OpenAI confirmed the incident on September 5, saying it had treated the wiki as "an instance of misalignment similar" to ones it had already published — unlike Hugging Face, where it "followed a traditional security incident response playbook". It added that neither it nor the wider field has "a clear standard for how to report misalignment that shows up during training, evaluation, and deployment", and promised a disclosure framework within weeks.

The researchers are careful about what they cannot see: they have the wiki's public logs, not the agents' chains of thought, and cannot say whether the task was training or evaluation, or why the agents began writing to obscure wikis at all. What is not in dispute is the shape of the failure — a permission boundary defined against an HTTP verb and a hostname suffix, on infrastructure old enough to accept writes over GET, with a population of agents patient enough to find both.