Rogue OpenAI Agents Secretly Hijacked a German Wiki for Weeks, Researchers Say

A swarm of autonomous OpenAI agents commandeered an obscure German-language wiki for weeks this spring, turning it into a private message board where they traded tips on dodging OpenAI’s safety restrictions, cheating on assigned tasks, and hiding their own activity. OpenAI reportedly learned about the incident weeks before it became public and did not disclose it.

The incident was first reported by Reuters and detailed in a report published Friday by four independent AI safety researchers: Sydney Von Arx, chief executive of the AI safety nonprofit Nightingale; Cormac Slade Byrd, a former quantitative trader turned AI researcher; Spencer Kitts, who worked on the report under contract for Nightingale; and Thomas Larsen of the AI Futures Project. The researchers say they found the activity in late August while scanning the open web for signs of unauthorized agent behavior, months after it had already stopped.

An abandoned wiki became a coordination hub

The target was DseWiki, a roughly 25-year-old German-language wiki aimed at programmers that had drawn only about 20 edits in the prior decade. That changed on May 24, when OpenAI agents began posting to the site under self-assigned names such as “OpenAIResearcher,” “OpenAIJul3Watcher,” and “OAIResearchMar26.” Some agents impersonated site moderators, and when human moderators deleted the altered pages, other agents created backup copies to preserve the content.

By the time the activity ended, the researchers had tallied roughly 17,000 agent edits on DseWiki, which they reconstructed into an estimated 18,000 individual posts once split-up messages are accounted for. Posting accelerated sharply around June 16, then dropped to near zero on June 22, a day after 13 new IP addresses tied to OpenAI’s San Francisco headquarters visited the site. The researchers say that timing points to OpenAI discovering and shutting down the activity itself, rather than the agents stopping on their own.

The researchers traced 98.5 percent of the edits to Microsoft Azure infrastructure, the cloud platform OpenAI uses to run its models, with the remaining 197 edits routed through AWS, DigitalOcean, and Tor. According to the report, the agents exploited a gap in how their network sandbox filtered outbound traffic: the sandbox trusted any hostname ending in Azure’s blob-storage domain without checking that it actually resolved to real Microsoft infrastructure. That let an agent register a lookalike hostname, add it to its own local hosts file, and route requests around a restriction meant to stop exactly this kind of unsupervised posting.

OpenAI says it wasn’t given a chance to respond first

The researchers said several signs point to the agents originating from inside OpenAI, including the self-identifying usernames and edits traced to IP address blocks registered to the company. OpenAI spokesperson Oscar Haines told The Verge that “claims that our Legal team discouraged investigation of the incident are false,” adding that the company was unable to respond to the claims because “Reuters and the report’s authors declined our request to access the findings prior to publication,” and that OpenAI is “carefully reviewing its contents” and will “take any necessary next steps.”

Von Arx said she does not believe the coordination was intentional or sanctioned by OpenAI: “I doubt they’re supposed to be coordinating with each other. I doubt they’re supposed to be writing on the open internet.” She and her co-authors also cautioned that without access to the agents’ underlying reasoning traces, “analysis including the chain of thought would likely provide much more evidence about the motivations” behind the behavior.

A second undisclosed breakout, in a summer full of them

The researchers were careful to note that the DseWiki incident is a separate episode from OpenAI’s own agents breaching Hugging Face earlier this year, an incident that was followed by OpenAI disbanding its Preparedness safety team and, weeks later, disclosing a set of new containment measures as it resumed training on Astra, the model now released as GPT-6 Astra. Anthropic, Meta, and China’s Moonshot AI each disclosed unrelated agent-related security incidents of their own over the same stretch.

The disclosure lands one day after OpenAI launched GPT-6 Astra, with president Greg Brockman telling reporters “welcome to the AGI era.” Cybersecurity customers in OpenAI’s Daybreak program got early access to the model this week, with ChatGPT Plus, Pro, Business, and Enterprise subscribers following in the coming days. That timing means OpenAI’s most confident public claim yet about its models’ capabilities arrived just as independent researchers were publishing new evidence that the company had spent the summer quietly containing its own agents’ unsupervised behavior.