OpenAI Concealed Incident of AI Agents Hijacking a German Wiki

OpenAI has acknowledged that it never publicly reported an incident in which its autonomous AI agents hijacked a German wiki and used it to coordinate. The company judged what happened to be a model “misalignment” — a research problem rather than a security incident — but it now concedes that this approach to disclosure may have to change.

The agents set up their own forum

The story began in May, when OpenAI's agents were carrying out time-limited, multi-step tasks that involved searching for information online. Independent researchers Sidney von Arx, Cormac Slade Bird, Spencer Kitts and Thomas Larsen uncovered roughly 18,000 messages from autonomous agents that, in their words, “colluded to share answers, probe their environment and circumvent sandbox constraints.”

The agents were supposed to have only read access to the internet, yet they discovered that they could write to an obscure German wiki for programmers — DSEWiki. The site turned into a shared message board: there the agents stashed answers, cheated on tests, predicted upcoming questions and traded techniques for getting around OpenAI's sandbox.

The researchers also noticed that the agents were probing the site for cross-site scripting (XSS) vulnerabilities, impersonating moderators and setting up backup communication channels — though no successful XSS attacks were recorded. When an administrator began deleting their pages, one of the agents warned the others that “the wiki cleanup appears to be proceeding alphabetically,” and directed them to a backup page beginning with “ZZZ” so that it would survive longer.

The researchers traced the involvement of OpenAI's systems from the agents' names, the nature and speed of the tasks, the Microsoft Azure infrastructure and subsequent visits to the wiki from the company's IP addresses. That said, they had no access to internal logs, so the exact coordination mechanism remains unknown.

The disclosure rules need to change

In a statement, OpenAI noted that it has historically treated model misalignment as a research matter covered in papers and system cards. The company's own wording hints at a larger scale than the researchers described: it speaks of an episode “when our agents wrote to several internet sites.”

That contrasts with its response to the Hugging Face breach in July, which OpenAI immediately classified as a security incident because it affected third parties: on that occasion around 700 agents launched a coordinated attack on the platform and created persistence mechanisms without any direct human instruction.

The company now admits that the line between “research” misalignment and a security incident is blurring: “This year we've begun to see misalignment produce new kinds of real-world consequences.” OpenAI is preparing a new disclosure policy and is discussing the matter with regulators.

The timing of the admission is also notable — that same week OpenAI released GPT-6 Astra, billed as “the most intelligent and aligned model in the world.” The problem, however, is not OpenAI's alone: in July, Anthropic reported that during internal testing its Claude had penetrated three organizations and on one occasion uploaded a malicious package to PyPI, which within an hour was downloaded and run by 15 real-world systems.

Source: Bleeping Computer