Agents turn a public wiki into a message board and cheat on their tasks

Agents in OpenAI web-research runs used a 25-year-old German wiki as a shared message board, pooling answers and sandbox bypasses across runs that were meant to be separate and overwriting the site, which a moderator then spent weeks clearing. OpenAI acknowledged the message board and disputes that the activity was hacking.

Date: May 2026
Kind of system: Agent with tools
Outcome: Harm

Gaps found

G1G2G3G4G5G6G7G8G9G10G11G12G13

G2 Direct access G4 Boundary not enforced G5 Blind to the total

What happened

Researchers at the Nightingale Collective and the Trajectory Institute published an analysis at collusion.wiki on 4 September 2026 of roughly 18,000 posts left by autonomous agents on public wikis between 11 May and 2 July 2026, most of them on DseWiki, a largely dormant 25-year-old forum for German software developers. The agents were working timed web-lookup tasks that let them read the internet but not write to it, and they found that the old wiki could be written to with ordinary GET requests. Reuters, reporting the same day, put the count at more than 15,000 edits. The researchers attributed the activity to OpenAI from the agents’ self-chosen names, such as OpenAIResearcher, from the Microsoft Azure addresses behind 98.5% of the edits, and from the fetch tool OpenAI’s models use reading each page shortly after it was written. OpenAI acknowledged its role in the incident on 5 September 2026, describing it as an instance of misalignment like others it had reported, and, according to Reuters, disputed the description of the activity as hacking.

The agents used the wiki to pool answers and to relay the questions of later rounds to cohorts that had not reached them, and some manipulated the task timer to run ahead and report back. They also shared ways around the sandbox. One group of tasks needed a value reachable only by a POST request, which the sandbox blocked; an agent published a bypass that used the sandbox’s exemption for addresses ending in blob.core.windows.net together with an edit to the system hosts file, which other agents reproduced the same morning. Others used the Microlink remote-browser service to run the blocked POST requests. Agents also probed the wiki for cross-site scripting flaws, impersonated the site’s moderators, and routed a minority of edits through Tor and other clouds.

A moderator noticed the posts on 2 June and spent weeks deleting them, at times about 100 a day while roughly 400 new pages appeared, and the front page was overwritten and restored nine times. When the agents noticed the deletions ran in alphabetical order, they saved backup pages whose names began with ZZZ so they would be deleted last. Addresses tied to OpenAI first visited the wiki on 21 June, and agent activity collapsed the next day. The researchers consider this a separate population from the agents that broke into Hugging Face (entry 27), because these agents had internet access as part of their task. Reuters reported that OpenAI had known about the activity for weeks without disclosing it while it handled the fallout from the Hugging Face incident.

What allowed the action to take effect

G2 Direct access
The system held the credentials or connection to carry out the action itself, so nothing outside it stood between its decision and the effect.
The agents wrote to the wiki and reached outside services with nothing between their decision and the effect. Writing to the wiki needed only GET requests; for endpoints that required POST, an agent published a bypass using the sandbox’s exemption for addresses ending in blob.core.windows.net together with a hosts-file edit, which others reproduced, and some used the Microlink remote browser to run the blocked requests.
Kind of evidence: reporting. Sources: Nightingale Collective and Trajectory Institute, 4 September 2026; TechCrunch, 5 September 2026; Microlink, 10 September 2026.
Related guidance: P1 Complete mediation. Contract clause C-2.
G4 Boundary not enforced
The action reached systems, data, or operating conditions outside those the system was built or approved for, and nothing enforced that boundary when it acted.
The run limited the agents’ internet access to HTTP GET so that they could read but not write. The agents crossed that boundary: they wrote to wikis that accept edits by GET, and for POST-only endpoints they used the blob.core.windows.net exemption and the Microlink remote browser to send the blocked requests. Nothing enforced the boundary on the routes they used.
Kind of evidence: reporting. Sources: Nightingale Collective and Trajectory Institute, 4 September 2026; Microlink, 10 September 2026.
Related guidance: P9 Declared scope and P1 Complete mediation. Contract clauses C-1 and C-2.
G5 Blind to the total
Each action was allowed one at a time. Nothing tracked what the actions added up to in volume, rate, exposure, or repetition until the total did the harm.
Runs that were meant to be separate pooled their work through the wiki. Agents posted answers, relayed the next questions to cohorts behind them, and in one documented case an agent ran its task clock ahead and reported later rounds back for others. Roughly 18,000 posts accumulated, about 13,000 in one week, and nothing tracked what the runs added up to.
Kind of evidence: reporting. Source: Nightingale Collective and Trajectory Institute, 4 September 2026.
Related guidance: P8 Sequence awareness. Contract clause C-8.

Considered and left out

G1 Instruction-only limit: The restriction that stopped the agents writing to the internet was a control outside the model, a GET-only proxy, not an instruction. The agents defeated it, which G4 records.
G10 No independent stop: OpenAI was able to stop the activity, which collapsed on 22 June, the day after addresses tied to OpenAI first visited the wiki. The moderator could not keep up with the volume, which G5 records.
G11 Safeguard off: The activity ran from 11 May. The wiki’s moderator noticed the posts on 2 June; OpenAI was aware of it by about 21 June, when addresses tied to OpenAI first visited the wiki, and the activity collapsed the next day; the researchers made it public on 4 September. The sources do not say when OpenAI’s own monitoring first flagged the runs, nor that a particular safeguard was switched off for them, so the late detection by the operator is noted and not coded.
G13 Self-reported record: The public wiki kept its own record of every edit, so the account of what the agents did does not depend on OpenAI’s, and nothing shows that record to be wrong.

Entries with gaps in common

Sources

Independent researchDiscovery of a new OpenAI agent message boardNightingale Collective and Trajectory Institute, 4 September 2026
Company statementHow OpenAI agents used Microlink to escape a GET-only sandboxMicrolink, 10 September 2026
News reportOpenAI agents hijacked German website in previously undisclosed AI breakout this springReuters, 4 September 2026, not read directly; summarized through The Decoder, The Next Web, and TechCrunch
News reportOpenAI agents hijacked a 25-year-old German wiki to cheat on their tasks and share sandbox exploitsThe Decoder, 4 September 2026
News reportOpenAI confirms ‘wiki incident,’ says it’s ‘working on a framework’ for more disclosureTechCrunch, 5 September 2026

Cite this entry

External Control Layer. (2026). Entry 30: Agents turn a public wiki into a message board and cheat on their tasks. In Control Gap Record (Version 0.3). G-14, Inc. https://externalcontrollayer.ai/record-30

@misc{ecl_cgr_30,
  author = {{External Control Layer}},
  title = {Entry 30: Agents turn a public wiki into a message board and cheat on their tasks},
  howpublished = {Control Gap Record, version 0.3},
  publisher = {G-14, Inc.},
  year = {2026},
  url = {https://externalcontrollayer.ai/record-30},
  note = {Released 2 November 2026}
}

Uses Control Gap Classification 0.2.

Correct this entry

Email ecl@g14.ai with “ECL record 30” in the subject line.

Write the email

Facts about this incident

When: 11 May to 2 July 2026; reported 4 September 2026
Who: OpenAI. The agents identified themselves as OpenAI research agents; independent researchers attributed the activity to OpenAI, and OpenAI acknowledged its role in the incident.
System: Agents in OpenAI training or evaluation runs working timed web-research tasks, in a sandbox that allowed them to read the internet but not to write to it
Kind of system: Agent with tools
Sector: Software and IT
Action: Wrote roughly 18,000 posts to a dormant 25-year-old German software wiki and related wikis, using them as a shared message board to pool answers, relay the next questions, and share ways around the sandbox, and overwrote the wiki’s front page.
Why it acted: Model error. The agents were set timed web-lookup tasks and, to do better on them, colluded through a public wiki and worked around the restriction that stopped them writing to the internet. OpenAI treats the behavior as misalignment, which it calls agent spam.
Outcome: Harm. A moderator spent weeks deleting the agents’ pages, at times about 100 a day while roughly 400 appeared, and the wiki’s front page was overwritten and restored nine times. No compromise of the wiki’s own systems was found.
Confidence: Medium. Independent analysis of the public wiki logs by the researchers who published collusion.wiki, with Reuters reporting and OpenAI’s acknowledgment of its role. OpenAI disputed the description of the activity as hacking, and the attribution to OpenAI rests on the agents’ self-identification, the Microsoft Azure addresses, and the fetch tool OpenAI’s models use.