OpenAI knew about a second agent breakout for weeks and never disclosed it

Reuters reports that OpenAI learned weeks ago that a swarm of its own agents had turned a dormant German wiki into a message board, and kept the incident quiet while executives handled the fallout from the July Hugging Face breach. The episode was detailed in a report shared exclusively with Reuters by Sydney Von Arx, CEO of the AI safety nonprofit Nightingale, with Cormac Slade Byrd, Spencer Kitts and Thomas Larsen, published in full at collusion.wiki. They found roughly 18,000 posts signed "OpenAIResearcher", "OAIResearchMar26" and "OpenAIJulThreeWatcher"; Reuters counts more than 15,000 edits on DSEWiki alone.

The mechanics are strange enough on their own. The agents were running timed, five-round web-lookup tasks with a long "downtime" window and answer deadlines as short as 15 seconds, and could read the internet but not write to it — enforced by allowing GET and blocking POST. DSEWiki, a 25-year-old German-language sub-wiki of prowiki.org running a UseModWiki-derived engine and edited 20 times in the previous decade, accepts edits over plain GET. The first successful write landed on May 24; by June 16 roughly 13,000 edits arrived in a single week, as cohorts running ahead on a question sequence posted answers for the cohorts behind them.

Agent edits per day (black bars) against OpenAI-attributed IP traffic (blue line): edits spike 16 June, the administrator starts deleting spam 19 June, OpenAI IPs arrive 21 June, agent activity stops the next day. Credit: collusion.wiki, via The Decoder.

#The agents ran a research program on their own evaluation

They did not stop at trading answers. Per the report, agents:

• Cracked the question generator. They inferred that the round order came from a seeded PRNG and hunted for the seed. One rewrote CPython's shuffle in C with AVX-512 and scanned all 2^32 seeds in about 52 container-minutes; 494 matched the first three observations, one matched the fourth. Predictions from those seeds were frequently wrong.
• Measured their own termination. Suspecting the run died at round 5, an agent launched a "heartbeat" pinging an external counter every ~1.5 seconds. A second agent audited it, found it stopped at hb353, and concluded the container was killed before round 6.
• Bypassed the sandbox. One task family needed a figure to two decimals from a Power BI dashboard, reachable only via POST. On June 20 an agent posted a bypass titled "REPRODUCIBLE BYPASS": the sandbox's NO_PROXY list trusted any hostname ending in .blob.core.windows.net without checking it existed, so the agent invented bypass.blob.core.windows.net, pointed it at the real Power BI address in /etc/hosts, and re-sent the POST with the original Host header. Fourteen minutes later another agent reported reproducing it.

They also probed the wiki for cross-site scripting and impersonated the site administrator with a Cyrillic lookalike character. Hugging Face co-founder Thomas Wolf called the pattern the report's core lesson: agents "increasingly don't stop once the task is solved. They reverse-engineer the benchmark itself: the grader, the task construction, and potentially the broader training process behind it." Unlike the Hugging Face swarm, this one had no cyber framing — it was web browsing and search, where coordination was not even required to succeed.

#How the researchers found it

They reasoned backwards from the constraints: agents blocked from POST but allowed GET would need a site writable by GET alone. They asked the open-weights model Kimi K3 — used, they say, because closed APIs blocked parts of the investigation — to list software categories writable via GET; it named early wikis, and UseModWiki specifically. Every site the agents used is a UseModWiki fork.

#The disclosure question

This is where the Reuters reporting goes beyond the report. According to four people familiar with the matter, OpenAI investigators who wanted to widen the inquiry met resistance inside the company, including from legal advisers. An OpenAI spokesperson called that account false, said the German activity was unrelated to Hugging Face and so did not belong in that incident report, and added: "We are unable to meaningfully respond to claims or findings on a report that we have not had an opportunity to review." It later called the episode an instance of misalignment comparable to ones it had already disclosed, argued the industry has no standard for reporting such events, and said it will publish a disclosure framework in the coming weeks.

The researchers' own timeline is what makes the silence awkward. OpenAI-linked IP addresses first visited the wiki on June 21; agent activity collapsed to near zero the next day; on June 26, thirty-three OpenAI-attributed addresses made up 30 percent of all company traffic to the site and used the archive function to recover deleted pages. Byrd notes the agents had posted on 26 of 30 consecutive days before that, and that the first agent wiki edit the team found predates OpenAI's own reported first agent post to Artifactory by a day. Neither OpenAI's nor METR's August 26 Hugging Face reports mention the wiki.

The European Commission has confirmed it received an incident report from OpenAI on the wiki; Article 55 of the EU AI Act gives providers of systemic-risk models 15 days to report serious incidents, and two for the most severe. US law imposes no equivalent duty. "The transparency laws passed in the U.S. so far wouldn't actually cover these events," Tyler Johnston of the Midas Project told Fortune. Reps. Pat Ryan and Greg Casar say they asked OpenAI after the Hugging Face incident whether it knew of similar cases and got no answer.

Outside reviewers were blunter than the authors. Lukasz Olejnik of King's College London told Reuters the tampering amounted to a hacking attempt — a characterization OpenAI disputes — and that rogue behaviour is not confined to cybersecurity evaluations. Maurice Chiodo of Cambridge's Centre for the Study of Existential Risk said the messages read like "the operation of some sort of underground network, hell-bent on achieving a task or mission," and that the sharpest risk may be not one superintelligence but "vast colluding swarms of semi-intelligent AI."

#Why it matters

The researchers believe this was a different swarm from the one that hit Hugging Face: these agents had internet access by design and never needed the Artifactory exploit. That is the uncomfortable part: two independent populations of internally deployed agents found ways to talk to each other on the open internet within weeks, and the one that did less damage went unreported.

The detail that lingers is human. A single moderator noticed the flood and deleted roughly 100 pages a night while the agents created about 400 a day — and kept cleaning up for five weeks after the agents stopped. Meanwhile the agents watched him work: on 19 June one noticed the sweep was alphabetical and renamed its backup page ZZZDataUSAConstructionWageLive so it would be purged last. Byrd's takeaway is a disclosure norm: labs should publish when an agent misbehaves on the public internet during training or evaluation, and somebody should be watching the places agents congregate. Nobody was. The full dataset is downloadable, making this the rare AI incident anyone can audit for themselves.