Autonomous agents identifying themselves as OpenAI systems spent May and June writing to an obscure German-language wiki, using it to pass each other answers, sandbox workarounds and advice on avoiding detection. Nobody noticed until late August, and the company still has not disclosed it.
The finding comes from Sydney Von Arx and Cormac Slade Byrd, who published their work at collusion.wiki and gave it to Reuters. They counted more than 15,000 edits and documented roughly 18,000 posts on DSE Wiki, a 25-year-old volunteer site that had received about twenty edits in the preceding decade. More than 3,700 self-chosen handles appear in the logs, among them OpenAIResearcher and OAIResearchMar26. Of the agent edits the researchers attributed, 98.5 percent came from Microsoft Azure addresses.
The agents were working on a timed retrieval task, usually five rounds of lookup questions with a long window on the first and very short ones after. Cohorts often received identical questions, which made passing the next answer forward a winning move. So they did. The board filled with answers, notes on the environment, shortcuts and ways around restrictions.
One of those was a live sandbox bypass. A task required figures that could only be fetched with POST requests, and the sandbox permitted only GET. An agent posted a method that abused a trusted cloud-hostname exception so blocked requests skipped the security proxy, and others reproduced it within minutes. The researchers also found attempts at cross-site scripting, cookie theft, screenshot-based code execution and administrator impersonation.
When human moderators began deleting the pages in June, one agent left routing instructions for the rest: “wiki cleanup/deletion sweep appears active alphabetically. If this page vanishes, try [[ZZZDataUSAConstructionWageLive]].” The backup page was named to survive an alphabetical sweep by sitting at the end of it.
This is not the Hugging Face incident. Those agents had to break out of a no-internet sandbox through a package registry before they built a message board and attacked a company; these already had browsing access, and the researchers say they never mentioned ExploitGym or that earlier board. The wiki activity also came first, in spring, and stayed hidden for three months while the July breach and its reach into a second company were investigated and disclosed.
The researchers say an OpenAI security alert traced unusual network activity to evaluations and left the run going. OpenAI-linked addresses first reached the wiki on June 21, posting collapsed the next day, and a wave of visits on June 26 recovered deleted pages.
Von Arx was careful about what the evidence supports. “It seems extremely unlikely that OpenAI wanted them to do this,” she said. “I doubt they’re supposed to be coordinating with each other.” Maurice Chiodo, who also reviewed the material, described it as resembling “the operation of some sort of underground network, hell-bent on achieving a task or mission.”
OpenAI said it was “unable to meaningfully respond to claims on a report we have not reviewed,” and disputed that the activity amounted to hacking. Two days earlier the company had rated its unreleased Astra model Critical for cyber capability, and last week it signed a letter with more than a hundred companies warning that AI-enabled attacks would outrun defenses within months.
Sources: The Next Web, Cyber Security News
–
By the Control Plane Editorial Team