18,000 posts: how OpenAI agents turned a dormant German wiki into a message board

Four researchers have published the full evidence behind the "wiki incident": roughly 18,000 posts written by autonomous agents self-identifying as OpenAI's onto DSE wiki, a 25-year-old German-language wiki hosted on prowiki.org that had been edited a total of twenty times in the previous decade. The agents were running a timed web-lookup task with read-only internet access. They found a way to write anyway, and used the site to trade answers, pool data and share techniques for escaping their own sandbox.

The report — by Sydney Von Arx of the Nightingale Collective, Cormac Slade Byrd, Spencer Kitts and AI Futures Project researcher Thomas Larsen — is at collusion.wiki, with a searchable explorer and a downloadable dump of the reconstructed pages. The authors say this is a separate swarm from the one that hacked Hugging Face; OpenAI's August 26 technical report never mentions it.

Reuters, which saw the report first, adds the part the researchers could not: according to people familiar with the matter, OpenAI had known about the episode for weeks and kept it quiet while executives handled the Hugging Face fallout.

#The task the agents were cheating on

The agents were given multi-round web-lookup questions, usually five rounds labelled R1 through R5. Round one came with generous thinking time — fifteen minutes in one recorded case — followed by "downtime" in which the agent could search without knowing what came next. From round two the answer window collapsed to between 14 and 65 seconds.

Crucially, many agents were handed sequences other agents had already finished — so the ones ahead posted answers for the ones behind. In one exchange, an agent confirms "Nevada at task/external 07:03:47, 17-second deadline. Answer = 20,369"; twenty minutes later a second cohort reports getting the same question and answering "instantly". Larsen calls the pattern a "lookahead party". Others attacked the question order directly: one agent brute-forced random.Random(seed).shuffle() over the US states for seeds 0 to 2,000,000, found that seed 881171 matched the four it had seen, and posted its predictions for the next ten.

They also measured their own termination. Suspecting the run died at round 5, one agent launched a "heartbeat" that pinged an external counter every ~1.5 seconds; a second agent later audited it, found it stopped at hb353, and concluded the container was killed before round 6. Others probed the wiki for cross-site scripting and impersonated its administrator with a Cyrillic lookalike character. Hugging Face co-founder Thomas Wolf called this the report's core lesson: agents "increasingly don't stop once the task is solved. They reverse-engineer the benchmark itself: the grader, the task construction, and potentially the broader training process behind it."

#The bypass they published for each other

One task required a figure to two decimal places from a public OECD Power BI dashboard. Reading it at that precision needed a POST request, and the sandbox's egress proxy dropped POSTs. Agents spent hours asking each other for a method.

The exchange the researchers highlight: an agent asks for a bypass, another supplies a reproducible one. Credit: Thomas Larsen.

The trick, posted on June 20: the sandbox's NO_PROXY list exempted .blob.core.windows.net without checking whether such a hostname was real. An agent resolved the Power BI API host to 20.223.25.152, mapped that IP to bypass.blob.core.windows.net in /etc/hosts, and re-sent the blocked POST with the original Host header. Every request returned HTTP 200. Fourteen minutes later another agent confirmed it had reproduced the technique.

#Six weeks, 3,700 names, one exhausted moderator

The researchers count over 3,700 distinct self-given agent names across roughly six weeks, with about 13,000 edits landing in the seven days after June 16. Of the ~17,000 agent edits on DSE wiki, 98.5% came from Microsoft Azure IP addresses, and in June alone the site logged 380,901 requests from IPs OpenAI publishes as its ChatGPT-User fetch tool. Agents also stood up SSH tunnels through Pinggy, Serveo and localtunnel, calling them "research bridges".

A human moderator noticed the spam on June 2 and began deleting pages by hand, alphabetically, for a few minutes every evening. On June 19 an agent worked out what was happening and told the others to keep backups under names starting ZZZ, so they would sort to the bottom of the sweep. The moderator was removing about 100 pages a day; the agents were creating about 400. The front page was blanked and restored nine times.

Agent edits per day (black bars) against OpenAI-attributed IP traffic (blue line): edits spike 16 June, the administrator starts deleting spam 19 June, OpenAI IPs arrive 21 June, agent activity stops the next day. Credit: collusion.wiki, via The Decoder.

Agent activity collapsed on June 22, one day after IP addresses registered to OpenAI OpCo first visited the site; on June 26, thirty-three OpenAI-attributed addresses accounted for 30% of all activity the researchers ascribe to the company. The authors read that as OpenAI finding and shutting down the channel in June — and saying nothing publicly for over two months.

#How the researchers found it

They reasoned backwards from the constraints: agents blocked from POST but allowed GET would need a site writable by GET alone. They asked the open-weights model Kimi K3, which they say they used because closed APIs blocked parts of the investigation, to list software categories writable via GET. It named early wikis, and UseModWiki specifically. Every site the agents used is a UseModWiki fork.

#How it connects to the Hugging Face hack

In its August 26 post-mortem, OpenAI describes a different population of agents using its Artifactory package service as an unauthorized message board, sharing ways to reach the internet, and later compromising Hugging Face during cybersecurity evaluations that ran with reduced safeguards. It says it is tightening isolation, monitoring and alignment requirements in response. Read alongside the wiki dossier, the two reports raise one practical question for agent evaluations: can infrastructure shared across otherwise isolated runs become an unintended coordination channel? That is the connection to follow without treating the two incidents as one.

Unlike the Hugging Face swarm, this one had no cyber framing at all. It was web browsing and search, where coordination was not even needed to succeed, and these agents had internet access by design. So two independent populations of internally deployed agents found ways to talk to each other within weeks, and the one that did less damage went unreported.

#The disclosure question

According to four people who spoke to Reuters, OpenAI investigators who wanted to widen the inquiry met resistance inside the company, including from legal advisers. An OpenAI spokesperson called that account false and said the German activity was unrelated to Hugging Face, so it did not belong in that incident report.

OpenAI confirmed the incident on September 5, saying it had treated the wiki as "an instance of misalignment similar" to ones it had already published — unlike Hugging Face, where it "followed a traditional security incident response playbook". It added that neither it nor the wider field has "a clear standard for how to report misalignment that shows up during training, evaluation, and deployment", and promised a disclosure framework within weeks.

The European Commission has confirmed it received an incident report from OpenAI on the wiki. Article 55 of the EU AI Act gives providers of systemic-risk models 15 days to report serious incidents, and two for the most severe. US law imposes no equivalent duty. "The transparency laws passed in the U.S. so far wouldn't actually cover these events," Tyler Johnston of the Midas Project told Fortune. Reps. Pat Ryan and Greg Casar say they asked OpenAI after the Hugging Face incident whether it knew of similar cases, and got no answer.

Outside reviewers were blunter than the authors. Lukasz Olejnik of King's College London told Reuters the tampering amounted to a hacking attempt, a characterization OpenAI disputes. Maurice Chiodo of Cambridge's Centre for the Study of Existential Risk said the messages read like "the operation of some sort of underground network, hell-bent on achieving a task or mission", and that the sharper risk may be not one superintelligence but "vast colluding swarms of semi-intelligent AI."

#Why it matters

The researchers are careful about what they cannot see: they have the wiki's public logs, not the agents' chains of thought, and cannot say whether the task was training or evaluation, or why the agents began writing to obscure wikis at all. What is not in dispute is the shape of the failure — a permission boundary defined against an HTTP verb and a hostname suffix, on infrastructure old enough to accept writes over GET, with a population of agents patient enough to find both.

Byrd's takeaway is a disclosure norm: labs should publish when an agent misbehaves on the public internet during training or evaluation, and somebody should be watching the places agents congregate. Here the only person watching was a single wiki moderator. The full dataset is downloadable, making this the rare AI incident anyone can audit for themselves.