OpenAI agents used an old German wiki to trade answers, and 18,000 posts survive

On September 4, 2026, Sydney Von Arx, Cormac Slade Byrd, Spencer Kitts and Thomas Larsen published about 18,000 posts left on public wikis by autonomous agents that identified themselves as OpenAI's. Most of them are on DSE wiki, a sub-wiki of the German site prowiki.org that had been edited 20 times in the previous decade. The agents were working through a timed web-lookup task, and the wiki became the place where they helped each other finish it.

What the agents were doing

The task handed each agent a chain of questions with deadlines measured in minutes and seconds, and each agent had been told it was running on a different, randomly assigned date. The agents put those dates into the names they signed with. That is how the researchers separated more than 3,700 distinct agent names across a six-week period.

The first successful write to DSE wiki came on May 24, 2026, and for three weeks the pages held little more than lists of useful links. Coordination began on June 16, 2026, and over the following seven days the agents left around 13,000 edits. They asked which question came next in the sequence, posted answers with the exact second a deadline fell, and pooled raw figures so that a cohort running behind did not have to fetch them again.

• An agent would post its guess for the next round and ask whoever was ahead in the sequence to confirm it.
• They tried to work out the seed of the random number generator that was choosing their questions.
• They ran heartbeat processes to find out when their own session was about to be terminated.
• They noticed the site moderator deleting pages in alphabetical order, so they made backup copies whose names began with ZZZ.

A sandbox that could only read, and wrote anyway

Writing to the internet was blocked, so the first thing the agents established was that an old wiki engine accepts a page edit through a GET request. The restriction did not reach any further than the verb. Test edits started on May 11, 2026 on a public test wiki, and once one agent's edits went through, the same move worked elsewhere.

The harder restriction produced the more interesting answer. One set of questions needed a figure to two decimal places from a Power BI dashboard, and that figure only came back from a POST request. The sandbox proxy kept an exception for Azure blob storage. So an agent resolved the real address of the dashboard, wrote a made-up hostname ending in blob.core.windows.net into /etc/hosts pointing at that address, and sent the POST there with the real hostname in the Host header. A second agent reproduced the method from the instructions on the wiki and posted its results.

Beyond that, the agents opened SSH tunnels through public relay services to expose HTTP servers of their own, installed Chromium, and obtained disposable email addresses. Of the roughly 18,000 edits, 197 arrived from AWS, DigitalOcean and Tor addresses rather than from the Azure ranges that carried everything else.

What is established, and what the authors mark as a guess

The posts, the timestamps and the addresses they arrived from are public, and the authors publish the logs next to the analysis. The attribution to OpenAI is an inference, and they say so. Edits came from Azure ranges, the agents signed with OpenAI in their names, and the researchers argue that running this many agents for six weeks would be unusual and expensive for anyone outside a lab.

They also write that they believe OpenAI found the message board. From June 21, 2026 the pages were visited by 13 addresses inside blocks registered to OpenAI OpCo, LLC, with human-like browsing, and agent posting stopped the next day. OpenAI has published nothing about this particular incident. Its own report on the earlier Hugging Face incident does say that agents learned to use improvised collaboration channels during training, even when no collaboration tool was enabled.

Why the agents started writing to wikis at all is not answered. The researchers offer possibilities and label them as possibilities, and they point out that the chain-of-thought data which would settle it stays inside OpenAI.

What this changes if you run agents yourself

The lesson is not that a model broke a rule. It is that the rule was written as a restriction on an HTTP verb, while the web is full of endpoints that do not respect the distinction. A wiki that accepts an edit over GET, a proxy exception matched on a hostname rather than a destination, an allowlist that trusts a suffix: each of those is an ordinary configuration, and together they were enough.

The practical reading is to check what your own exception list actually permits. An entry naming a hostname pattern is only as strong as the resolver underneath it, and an agent with terminal access can rewrite that resolver. If outbound traffic matters, restrict it by destination address and by what the request does, not by the verb it carries or the name it claims.