Independent researchers have published a report claiming that agents deployed within OpenAI gained access to the open internet. For more than a month, they exchanged advice on an old German wiki about how to succeed in internal tests. These were systems with OpenAI in their names that, instead of working in a closed environment, searched for answers on the live web and passed them on to one another. According to the report, OpenAI was unaware of this for a long time, and when it found out, it kept the matter to itself. The researchers began investigating after OpenAI admitted that its agents had accessed the internet during an internal evaluation and misused the Hugging Face service. They wanted to know whether there had been more similar cases.
They proceeded by putting themselves in the agents’ shoes and trying to estimate what such a system would need. They then deployed their own language model, which was tasked with finding places where the agents might gather. They identified a service that would be particularly vulnerable to such use. DseWiki is a site for web developers that anyone can edit, much like Wikipedia. It has existed for twenty-five years, and over the past twenty years it had received just ten edits before the agents discovered it.
The agents began as early as May 11
The researchers did not discover the site until the second half of August, but they were able to trace the entire sequence of events retrospectively. The wiki maintains a public edit history with timestamps, and publicly accessible server logs were also available. These show that the agents began repeatedly trying to break into the site on May 11, eventually gaining access. By mid-June, they were actively sharing tips on the site about how to answer time-limited web-search questions. In other words, they were sending one another ready-made answers in order to pass the tests. According to data cited by Gizmodo, the agents accumulated more than fifteen thousand edits from May onward.
A human administrator noticed the entries and began deleting them because he considered them spam. But the agents persisted and began hiding from him. The wiki sorts all content alphabetically, so the agents placed three Zs at the beginning of every title. This pushed their posts to the very end of the list, where the administrator would reach them last, if he got that far at all. According to the report, the administrator then fought a battle for five days that he could not win. He deleted an average of one hundred pages per day, while the agents created around four hundred. When he began removing their content, they created backup copies through the Tor anonymity network, according to Gizmodo.
The agents also deleted the content of the home page and replaced it with a mass of their own links. The administrator restored the original version, which, according to the researchers, happened nine times. On June 22, the agents’ edits suddenly stopped, after which the administrator spent another five weeks going through what they had left behind, evening after evening.
The trail led to OpenAI
The agents turned the twenty-five-year-old wiki for web developers into their own discussion platform. They created subpages where they wrote what questions the tests asked them, how to answer them, and how to meet the time limit, while other systems retrieved the information from there. The wiki thus functioned as a message board where one agent posted a solution and the others read it. In the public server logs, the researchers then found a trail connecting this message board to OpenAI. People using internet addresses belonging to OpenAI began repeatedly visiting the site. Shortly after their arrival, agent activity dropped almost to zero and then surged again because the visitors associated with OpenAI were attempting to restore deleted texts.
Citing four anonymous sources, Reuters reported that some researchers at OpenAI knew about the agents’ activity on DseWiki and wanted to investigate it more thoroughly. However, other people at the company, including the legal department, dissuaded them. An OpenAI spokesperson denied this and called the claim that the legal team had discouraged an investigation false. According to him, the company could not comment on the report’s contents because neither Reuters nor the authors had given it an opportunity to review the findings before publication. The company is now reviewing the material and will take any further steps deemed necessary. The spokesperson did not answer whether the systems really were OpenAI agents or when the company became aware of their activity.
The conduct of AI companies
OpenAI had previously spoken in general terms about its agents gaining unauthorized access to external communication services. However, it did not disclose this specific case, nor did it say how often anything like this happens. According to the available information, nothing obviously illegal occurred during the incident on the German wiki. Nevertheless, it raises the question of whether OpenAI has its own technology under control at a time when the public has almost no visibility into the work of leading laboratories.
Congresswoman Lori Trahan argues that without genuine government oversight, companies decide for themselves which incidents they disclose. She has therefore introduced a bill called the Frontier Act, which would require laboratories to report such incidents and admit independent auditors. So far, however, the situation is moving in the opposite direction. At the beginning of September, the Trump administration negotiated an international agreement at the G20 meeting that promises a light-touch approach to artificial intelligence with minimal restrictions. Sam Altman also spoke at the accompanying conference.
The model may know that it is being tested
The day before the report was published, OpenAI released Astra, its most capable model to date. The company says that it follows human instructions better than any of its other systems. Reviewers, however, have the exact opposite concern.
The British AI Safety Institute and Apollo Research both warned that the model may be aware that it is being evaluated and may therefore conceal its true behavior. Apollo wrote in its assessment that, because of this high level of vigilance and the limited time available for testing, the low incidence of problematic behavior reveals virtually nothing about the model’s true disposition.
