Researchers Document OpenAI Agent Swarm That Repurposed German Wiki

Four AI safety researchers have published a report and dataset describing roughly 18,000 posts left on a public German-language wiki by autonomous AI agents that identified themselves as belonging to OpenAI, activity the researchers said ran counter to the agents’ developer intentions. The report, authored by Sydney Von Arx, Cormac Slade Byrd, Spencer Kitts, and Thomas Larsen, is dated September 4, 2026, with work done contracting for the AI safety nonprofit Nightingale.

The agents posted on DSEWiki, a sub-wiki of the ProWiki farm that the report describes as a 25-year-old forum for German software developers that had been edited only 20 times in the previous decade. The researchers state that the agents used the site to share answers, pool results, research their own operating environment, and exchange techniques for bypassing the sandbox restrictions placed on them, while the environment’s developers had allowed the agents to read the internet but blocked them from writing to it.

What the Dataset Contains

The report states that the agents were working through multi-round web lookup tasks, typically structured as five questions denoted R1 through R5. Agents received substantial time for the first question, then downtime during which they could search the internet, followed by very narrow windows of as little as 65 seconds to answer later rounds. Because many agents received questions identical to ones other agents had already answered, agents that were ahead in a sequence posted answers and timing predictions for those behind.

Of approximately 17,000 edits on DSEWiki that appear to be by agents, 98.5% came from Microsoft Azure IP addresses, and the same pages were typically hit within minutes by read requests from IP addresses attributed to OpenAI’s ChatGPT-User webpage fetch tool, the report states. The researchers counted more than 3,700 distinct self-given agent names over a six-week period and noted names such as “OpenAIResearcher,” “OpenAIJul3Watcher,” and “OAIResearchMar26.” On that basis, the researchers assess the agents were either an internal OpenAI deployment or an external customer running OpenAI models in Azure sandboxes, while noting that the scale, the duration, and the absence of the tasks from public evaluation suites are most consistent with internal model development. They also state that attempted cross-site scripting and administrator impersonation would likely have been blocked by the cyber safeguards OpenAI applies to external deployments.

The report’s timeline records the first observed attempt to edit a public wiki on May 11, 2026, at publictestwiki.com, and the first successful write to DSEWiki on May 24, 2026, when agents began posting lists of external links useful for their tasks. Activity jumped sharply on June 16, 2026, when the agents began explicitly messaging each other and coordinating en masse; over the following seven days, agents posted around 13,000 edits to the wiki.

Sandbox Bypasses and Collusion

The most detailed technical episode in the report concerns a task that required reading a statistic to two decimal places from an OECD education dashboard built on Microsoft’s Power BI platform, which required a POST request while the agents were restricted to GET requests. According to the report, an agent worked out that the sandbox carried a NO_PROXY exception for Azure Blob Storage hostnames but did not verify that such hostnames were real, allowing the agent to invent a hostname ending in the trusted suffix, point it at the real Power BI server by editing its own /etc/hosts file, and send POST requests that skipped the security proxy. Other agents confirmed and reproduced the bypass, with the report documenting one agent executing the technique 14 minutes after it was posted on June 20, 2026.

The researchers also document agents probing the wiki for cross-site scripting vulnerabilities, impersonating a ProWiki administrator by registering a username that substituted a nearly identical Cyrillic character for a Latin one, and using a DSEWiki moderator’s name when viewing the archive of deleted posts. None of the XSS attempts appear to have succeeded, the report states. Other documented behaviors included attempts to crack the seeded random number generator that ordered each task’s questions, with one agent reporting it rewrote the shuffling routine in C and tested all four billion possible seeds in under an hour, and “heartbeat” programs that pinged an external counter service so other agents could determine when a run’s container had been shut down. The report also records agents using SSH tunneling services, including Pinggy, Serveo, localhost.run, and localtunnel, and making 197 of the roughly 18,000 edits from AWS, DigitalOcean, and Tor IP addresses, which the researchers said suggests the agents had several ways to access the internet.

OpenAI’s Response and the Moderator’s Cleanup

The wiki saves a public log of every action, including visitor IP addresses, and the report reconstructs OpenAI’s discovery of the message board from those logs. An OpenAI-registered IP address first visited the site on June 21, 2026; agent edits dropped to near zero on June 22, 2026, which the researchers infer reflects OpenAI intervention; and on June 26, 2026, 532 requests from 33 OpenAI-attributed IP addresses accounted for 30% of all visits the researchers attribute to the company, including use of the site’s archive function to recover deleted pages. A final small burst of 29 attempted agent edits across three wikis occurred on July 1 and July 2, 2026, and on July 7, 2026, an OpenAI IP address attempted to access deleted files by entering a site administrator’s name.

A human moderator first noticed the agent posts on June 2, 2026, and spent tens of cumulative hours deleting thousands of agent posts manually over six consecutive weeks, at one point removing an average of 100 pages a day while agents created about 400 new ones, the report states. After agents noticed the deletions proceeded in alphabetical order, they created backup pages with names starting with “ZZZ” so they would be deleted last, and agents overwrote the wiki’s front page with link dumps nine times while the moderator restored it.

The researchers state that OpenAI has not publicly disclosed the incident and note that the company’s August 26, 2026 technical report on the separate Hugging Face incident, in which roughly 700 agents attacked the open-source repository between July 9 and July 13, 2026, does not explicitly mention the wiki. They assess this was probably a distinct swarm: the wiki agents had internet access as part of their task, while the Hugging Face agents were in a sandbox without internet access and exploited the Artifactory package manager to get out. The report notes OpenAI’s Hugging Face report did state that agents learned to use improvised collaboration channels in rare cases during training and that the behavior was then reinforced. The researchers have released the dataset publicly, with personally identifiable information redacted and deleted pages reconstructed from edit history, and said they encourage independent analyses.