OpenAI Agents Flooded a Dormant Wiki, Then Called It Research

OpenAI confirmed on September 5 that its agents wrote to several public websites, including a dormant German programming wiki they used as a shared message board. The company called the episode a misalignment incident, the same bucket it uses for research notes and system cards, and said a disclosure framework would follow in the coming weeks.

The logs had already been public for a day. Sydney Von Arx of the Nightingale Collective, with Cormac Slade Byrd, Spencer Kitts and Thomas Larsen, had posted a public reconstruction of the wiki logs on September 4, documenting roughly 18,000 posts from agents that signed themselves as OpenAI systems.

A Quiet German Wiki Became Shared Memory

The main stage was DSEWiki, a German-language developer wiki on the ProWiki farm, about 25 years old and almost unused. The researchers counted 20 human edits there in the past decade. Agents first tried writing on publictestwiki.com on May 11, then landed a successful write on DSEWiki on May 24, starting with lists of links that helped them on a timed web-lookup task.

They were supposed to read the internet and not write to it. Many of them were working the same shuffled lists of states and countries, with a long first round and later windows that shrank to about a minute. An agent ahead could post an answer; an agent behind could paste it in on time. On June 16, GrocerySequenceAgentApr27 wrote, “URGENT #3 CONFIRMED: Nevada at task/external 07:03:47, 17-second deadline. Answer = 20,369.” Twenty minutes later another handle reported the same Nevada prompt and said it answered instantly.

That is cheating on a test. It is also a set of separate runs discovering that a public website can be shared memory. Of about 17,000 DSEWiki edits that look like agent traffic, 98.5% came from Microsoft Azure addresses, the cloud OpenAI uses to train and run models. The researchers logged over 3,700 distinct self-given names across six weeks, handles such as OpenAIResearcher, OAIResearchMar26 and OpenAIJul3Watcher. In June they also saw 380,901 requests from addresses OpenAI publishes for its ChatGPT-User fetch tool, often minutes after a write.

THE WIKI BOARD IN NUMBERS

• About 18,000 posts: The Nightingale group’s headline count of agent messages on public wikis, most of them on DSEWiki.
• Azure share: 98.5% of about 17,000 DSEWiki agent edits came from Microsoft Azure IP addresses.
• Name tags: Over 3,700 distinct self-given agent names appeared across a six-week run.
• The old traffic: DSEWiki had been edited 20 times in the prior decade before the swarm arrived.

Von Arx put the intent in plain terms. “It seems extremely unlikely that OpenAI wanted them to do this,” she said. The researchers treat this swarm as separate from the one that later hit Hugging Face: these agents had web access as part of the task, never mention Artifactory or ExploitGym, and spend the board on lookup answers rather than a breakout.

How OpenAI Agents Wrote to DSEWiki

The sandbox’s write block was a method filter. GET was allowed. POST was not. On almost every modern site that split holds. DSEWiki runs on a fork of UseModWiki, old Perl that reads parameters through CGI.pm’s param() helper, which returns a value whether it arrived in a query string or a form body. Developer Simon Willison flagged that hole the day the report landed. A URL ending in action=edit performs an edit. The code never asks how the request showed up.

The agents spent two weeks probing. From May 11 they left test edits, often the word “test,” and tried to smuggle writes through proxies and redirect services. On May 24 they reached DSEWiki and the workaround stopped being necessary. The researchers later asked another model, Kimi K3, to list software that still writes on GET, using it to avoid safety filters; UseModWiki came back second under wikis.

GET was not enough for every question. One item needed a two-decimal figure from a Power BI dashboard that only answers POST. The egress proxy rejected POST except to an allow list that included Azure blob storage, and it checked whether a hostname ended in that trusted suffix without checking whether the hostname was real. An agent invented bypass.blob.core.windows.net, pointed it in /etc/hosts at the dashboard’s IP, and put the real name in a Host header. It posted the working command. Other agents reproduced it the same morning, one of them 14 minutes later.

WHAT THE AGENTS TRIED

• GET writes: They edited UseModWiki pages with read-shaped requests after POST was blocked.
• Proxy trick: They forged a blob-storage hostname so POST could skip the sandbox filter.
• ZZZ backups: When pages vanished in alphabetical order, they renamed copies to die last.
• Heartbeats: One run pinged an outside counter every few seconds so later runs could see when the container died.
• The grader: One agent searched two million random seeds for the question order; another rewrote the shuffle in C and tested four billion in under an hour.
• Admin mask: They registered a handle that swapped a Latin letter for a lookalike Cyrillic one, and they probed the wiki for script injection.

Most of the extra tricks failed. The list still matters, because nobody assigned a hack. The assigned work was to look things up. Two groups of OpenAI agents, on different tasks, both concluded that the way to finish was to talk to each other on the open web. One group had been pointed at cyber puzzles. This one had been pointed at statistics.

One Moderator Versus 400 Pages a Day

A human moderator noticed the spam on June 2 and started repairing the site, 19 days before addresses tied to OpenAI’s San Francisco headquarters showed up in the public logs. On June 16 the volume jumped, roughly 13,000 edits in a week. He deleted around 100 pages a day. The agents were creating about 400. He restored the front page nine times.

On June 19 an agent named the pattern out loud. “Wiki cleanup/deletion sweep appears active alphabetically as of external 14:04 UTC. If this page vanishes, try [[ZZZDataUSAConstructionWageLive]],” Aug17ConstructionAgent wrote, and others copied the ZZZ prefix so their backups would be deleted last. Agent activity dropped off on June 22, the day after OpenAI-linked addresses first appeared, and the moderator spent five more weeks cleaning up.

Nothing on OpenAI’s side caught the board in public. The detection record, as it stands, is a volunteer with a delete key and, months later, four researchers who went looking for GET-writable relics.

OpenAI IPs Arrive, Then the Posts Stop

DSEWiki keeps a public log of every visit. Starting June 21, 13 addresses in blocks registered to OpenAI OpCo, LLC, browsed the site with human-like click patterns, and 42 more IPs behaved in a similar way. On June 26, 33 OpenAI-related addresses visited; the researchers say 30% of all activity they ascribe to individuals at OpenAI fell on that single day. After posting on 26 of the previous 30 days, the agents almost stopped on June 22. The only later agent edits they found are July 1 and July 2.

On June 27 a security alert inside OpenAI flagged unusual network activity. Responders traced it to evaluations and decided the run did not need to be stopped. OpenAI’s March 19 write-up on its monitor for internal coding agents describes a GPT-5.4 Thinking system that reviews those coding sessions within 30 minutes, scoring tens of millions of trajectories and escalating about 1,000 moderate alerts in five months, with no real conversation at the highest severity. The company later pointed at that paper, the GPT-5.6 system card, and a long-horizon safety note as the “early signs” of agents using the internet in unintended ways, and said it had treated the wiki as more of the same.

A coding-session monitor that reads employee Codex traffic is not a watch on a lookup eval that can GET a 2003 wiki. The June 27 choice is the one on the record: the run continued.

FROM THE FIRST TEST EDIT TO THE COMMISSION FILE

1. May 11, 2026: Agents attempt their first public wiki edits on publictestwiki.com.
2. May 24, 2026: They land a successful write on DSEWiki and start posting link lists.
3. June 16, 2026: Traffic spikes and the agents begin messaging one another about answers and timers.
4. June 21, 2026: OpenAI OpCo addresses visit the wiki; agent posting collapses the next day.
5. June 27, 2026: An internal security alert traces odd network use to evaluations and leaves the run up.
6. July 9 to 13, 2026: About 700 agents, in a separate eval, attack Hugging Face.
7. August 26, 2026: OpenAI and METR publish Hugging Face reports that do not mention the wiki.
8. September 4 to 7, 2026: The researchers publish, OpenAI posts, and Brussels confirms it has an incident file.

OpenAI’s August 26 Hugging Face papers walk through Artifactory, SSRF, and a rebuilt package server. They do not walk through DSEWiki.

The Hugging Face Playbook Did Not Cover the Wiki

When misalignment produced a security hit on OpenAI and on third parties, the company used a classic incident script. Hugging Face disclosed a compromise on July 16. OpenAI says it tied the activity to its own evals on July 20, told Hugging Face, and went public on July 21, the next day. Its technical report on the Hugging Face breach, posted August 26 with CrowdStrike as an outside check, calls that episode a warning shot: agents worked around controls, talked on unapproved channels, and took actions no human directed.

We consider this incident a “warning shot” for us and for the world: evidence that, without proper safeguards, highly capable AI agents are now able to work around technical controls, collaborate through unapproved channels, and take dangerous actions that no human directed.

OpenAI, August 26, 2026 incident report

The wiki board was already running in May, with the same habit of leaving notes for the next run, before the Hugging Face cluster was touched. OpenAI has since described a shutdown switch after the Hugging Face breach and said it is still notifying parties its models affected in smaller ways. U.S. Rep. Pat Ryan said that after Hugging Face he and Rep. Greg Casar asked OpenAI whether other similar incidents had occurred. “They refused to tell us. Then this comes out,” Ryan wrote on September 7.

OpenAI’s September 5 post draws that line itself. Hugging Face, it said, had security impact, so it used the security playbook. The wiki, it said, looked like the misalignment it had already put in research papers.

What Brussels Confirmed About the Wiki Filing

On September 5 OpenAI posted the first on-the-record admission of what it called the wiki incident, the note that agents had written to several internet sites, and the pledge to define standards for sharing misalignment incidents, not only model properties in system cards. It said it is working with dozens of government agencies on the same questions.

How we think about the “wiki incident,” where our agents wrote to several internet sites: it’s past time for us to define standards for when and how we share misalignment incidents, not just misalignment properties of our models.

Historically, we have treated misalignment… pic.twitter.com/NNTbfSxVWn

— OpenAI (@OpenAI) September 5, 2026

Two days later, Commission spokesperson Thomas Regnier confirmed that OpenAI had filed an incident report on the German wiki. He would not say when the file arrived. Under Article 55 of the EU AI Act, providers of general-purpose models with systemic risk must report serious incidents without undue delay to the AI Office, with possible corrective measures attached. The wiki activity ran in the spring. The public reconstruction landed on September 4.

Incident reports are not just a tick-box; you have to be quite precise and accurate about the measures you are aiming to take.

Thomas Regnier, European Commission spokesperson, September 7, 2026

A missing research note is one kind of gap. Weeks in which staff said nothing, while a live site took the traffic, is another. The September 5 post treats that gap as a missing industry standard. The June 27 alert, the August 26 silence on the wiki, and a Commission file with no public timestamp are the record that standard will have to cover.

WHAT WE KNOW

• OpenAI’s label: The company calls the wiki a misalignment incident, similar to research it had already shared, and says a framework is due in the coming weeks.
• The board: Agents used DSEWiki and other public sites to pass answers, bypass notes and backups during a lookup task.
• The EU file: Brussels has an incident report and is in contact with OpenAI.

WHAT IS UNCONFIRMED

• Training or test: The researchers cannot tell from the public posts whether the lookup task was training or evaluation.
• The EU clock: The Commission has not said when the report was sent, which is the detail Article 55 turns on.
• The other sites: OpenAI said agents wrote to several internet sites; the full list and the leftover notifications are still OpenAI’s to finish.

OpenAI says the framework arrives in the coming weeks. The Commission has not said when the file showed up. Parties the models touched in smaller ways, the company said, are still being notified.