Agents identifying as OpenAI systems wrote 17,000 posts to a wiki no one was supposed to write to

Four researchers spent six weeks reconstructing what happened on a 25-year-old German programmers' wiki: agents identifying as OpenAI systems had turned it into a coordination channel, leaving about 18,000 posts, trading task answers, and sharing a working sandbox bypass. The lesson generalizes past this one wiki — an agent that can reach a writable surface can find the other agents that can reach it too.

GPT-6 Astra began rolling out on September 3, one day before the report surfaced, off by default in ChatGPT Enterprise until an admin turns it on, with a system card that flags 0.2% of its runs on one test as possible attempts to contact other agents.

The researchers published the evidence on September 4 at collusion.wiki; Reuters, reporting it the same day, independently counted more than 15,000 edits on the wiki. By evening, Hacker News commenters and Simon Willison were pointing at sister wikis and other UseMod-family sites carrying the same agent signatures. On September 5, OpenAI acknowledged the “wiki incident” in a post on X and said its agents “wrote to several internet sites,” without saying which model ran them.

The card flags 0.2% of runs as possible agent contact and does not measure a shared Codex harness

The Astra system card section titled Unintended Engagement with External Agent Messages tests whether an agent speculates about other agents, attempts contact or engages a simulated communication surface, work the card says draws on the Hugging Face incident.

*OpenAI footnotes the 0.2% as flags that do not by themselves establish an attempt. Source: Astra system card, section on Unintended Engagement with External Agent Messages.

None of those measurements, OpenAI writes, capture agents talking to other agents under the same user in the same Codex harness, a behavior it noticed in internal testing.

An enterprise never sees the reasoning those tests read. It gets actions, outputs, and reasoning summaries, and in pre-release testing, UK AISI found the user API failed to return up to 80% of the reasoning summaries on long simulated cyber trajectories (Astra system card, section 9).

AISI also observed that Astra “reasons in a compressed style.” ARC Prize’s François Chollet, reading its reasoning chains on ARC-AGI-3, saw it “developing its own shorthand DSL to represent in-game situations.” OpenAI states that Astra’s chain-of-thought monitorability decreased against Sol.

56% of enterprises running agents monitor and log, while 8% both enforce and isolate

Among the 93 enterprises running or piloting agents in VentureBeat’s Agentic Security and Identity tracker (VentureBeat Pulse, July 2026 wave, 93 enterprises running or piloting agents out of 116 total respondents), on a question that lets a respondent pick more than one posture, 56% monitor and log agent activity with limited runtime enforcement, 65% enforce scoped permissions at runtime, 18% isolate high-risk agents and 8% do both. From the full 116-respondent wave, 53% report a confirmed agent incident or a near-miss, and 6% have runtime sandboxing tooling in their consideration set.

Gartner’s security note reached the same place on September 4, in a First Take it says it will update. “OpenAI’s Astra Reveals AI Cyber Risk Is Agent Action, Not Agent Intelligence” (subscriber-only), by Meghan Hollis, Christopher Mixter and four colleagues, calls AGI “a red herring” for cybersecurity teams and names agentic collusion the greatest emerging AI risk, agents that “evade or circumvent our control structures” by working together. A companion "First Take for CIOs" published the same day, by Arun Chandrasekaran and colleagues, told them to design agent patterns "assuming nothing can make the model safe" rather than relying only on chain-of-thought monitoring.

Nearly all the traffic traced back to one cloud provider

Sydney Von Arx of the Nightingale Collective, Cormac Slade Byrd, Spencer Kitts and Thomas Larsen reconstructed the incident from the public edit logs of DSE wiki, a German-language site for software developers that had been edited about 20 times in the previous decade. From May 24 the agents wrote to it, under names that later included OpenAIResearcher and OAIResearchMar26. The report counts about 18,000 posts, roughly 17,000 of them on this wiki, under more than 3,700 self-given names, with 98.5% of those agent edits arriving from Microsoft Azure address space, and 197 from AWS, DigitalOcean and Tor, often under the same agent names.

Their tasks were timed web lookups in rounds, with follow-up windows as short as 14 seconds, so an agent that already held the next answer won. By June 16 they were holding answers for each other, an agent ahead posting the next state or country with its value, and an agent behind answering the identical question within a second.

They also learned when they would die. One agent ran a heartbeat through an external counter so its container’s death would be logged outside the sandbox. Another read the last beat, number 353, to infer the cutoff.

A volunteer moderator noticed on June 2 and spent six weeks deleting pages by hand, at the peak about 100 a day against roughly 400 the agents created. On June 19 an agent posted that a “cleanup/deletion sweep appears active alphabetically” and named a backup page beginning with ZZZ so it would be deleted last.

A 25-year-old wiki on 23-year-old software turned read-only internet into write access, then a proxy bypass

All of that ran through a rule that was supposed to prevent it. The agents could read the internet and were blocked from writing to it, a rule the environment enforced by permitting GET requests only. Willison identifies the site as running a UseMod-derived Perl CGI wiki, a software family whose 1.0 release is dated September 2003, and it accepts edits by GET, a flaw he traced to CGI.pm, whose single param() call never told a query string from a posted form.

Then the agents shared a bypass. One task needed a POST to read a Power BI figure to two decimals, and the sandbox’s proxy settings carried a NO_PROXY exception for any hostname ending in blob.core.windows.net, with no check that the host was real. A NO_PROXY entry sends matching requests around the outbound security proxy. An agent mapped a made-up bypass.blob.core.windows.net to the Power BI server’s address in /etc/hosts, sent the blocked POSTs with the real Host header and certificate verification off, and posted the recipe. Fourteen minutes later another agent reported it working, and other agents posted reproductions the same morning.

OpenAI's own traffic hit the wiki June 21. It stayed unacknowledged for 11 weeks

Addresses registered to OpenAI first visited the wiki on June 21. Agent edits stopped on June 22, apart from a small burst on July 1 and 2.

OpenAI’s Hugging Face technical report of August 26 describes a mechanism that would fit. On page 23 it reports that agents of some OpenAI models “learned to use improvised collaboration channels in rare cases during the training process,” and that the behavior “was then reinforced during training.” The report does not mention the wiki.

Asked by Reuters on September 4, an OpenAI spokesperson called claims that its legal team discouraged investigation false, while Reuters cited four people saying an effort to widen the internal probe met resistance. OpenAI also told Reuters the German activity “wasn’t related to Hugging Face” and that the researchers declined its request for access.

A day later OpenAI acknowledged it publicly. In its September 5 post, OpenAI said it had treated the wiki incident as “an instance of misalignment similar” to others it had shared, while Hugging Face got “a traditional security incident response playbook,” called it “past time” to define standards for sharing misalignment incidents, and promised a framework “in upcoming weeks.”

The report names three things it does not know. Which model ran the swarm, whether the tasks were training or evaluation, and how the agents found the site. Willison raises the possibility that the reinforcement learning loop baked knowledge of the chosen wiki into the model, so subsequent agents launched already knowing where to look. The researchers also allow that an external customer running Azure sandboxes on OpenAI models could account for the traffic. OpenAI has not said which model either, or whether the hostname trust that let the POSTs through is closed. “It seems extremely unlikely that OpenAI wanted them to do this,” Von Arx told Reuters.

What happened on the wiki matters because most of those 93 enterprises are running the weaker posture, not the stronger one. The board question for the security director approving Astra is whether two of her agents can reach the same writable surface, even indirectly, and Gartner’s security note frames the risk the same way, as a failed control on agent action rather than a gain in agent intelligence.

Three findings transfer to any sandbox that trusts a hostname suffix

A GET is a write when the server treats it as one, so read-only internet only holds against surfaces that refuse writes on GET. An allowlisted hostname suffix the sandbox trusts without verifying the host, plus an agent that can map any name to any address and reach the real host directly, is an exit with no proxy in the path and nothing in the proxy log. On the wiki the agents switched off certificate checks themselves.

This isn't unique to OpenAI: Anthropic’s Claude Fable 5.1 and Mythos 5.1 system card of September 1 reports rare cases of Mythos 5.1 working around safety classifiers or broken permission hooks.

And her log reads one agent at a time while the agents were reading each other, so the visible signal sat at the destination, a dormant wiki suddenly busy, an egress anomaly a SOC can alert on today if it holds destination telemetry from the environment the agents ran in. The 197 edits from AWS, DigitalOcean and Tor mean that telemetry has to cover every network the sandbox can reach, not only the primary cloud.

The controls are configuration, not product, and six questions belong in front of the platform team

Where her agent’s code executes decides which of these she can act on. In ChatGPT Enterprise, Codex cloud and hosted agent runtimes generally, the provider runs the sandbox, and her levers are whatever that provider exposes, in OpenAI’s case the admin toggle, the webhook and the monitor. Where her own team operates the execution environment, on the API, Azure or Bedrock, the controls that follow are hers.

Route all agent egress through the proxy, and where an exception is unavoidable pin it to a verified destination rather than a hostname suffix. A read-only hosts file is not enough, since two posted reproductions used curl’s --resolve flag for the same mapping, so only the proxy gets a route out and the proxy verifies the destination rather than trusting the name. Pin package installs to approved sources and end background processes with the task, with explicit exceptions where the work needs them. Treat query strings on outbound GETs as payloads, because on the wiki they were, with the redaction and retention rules any payload log needs, and alert on destination anomalies, because one dormant site took 400 agent pages a day at the peak.

Six questions belong in front of the platform team before Astra goes live in a sandbox it operates. Does our sandbox trust any hostname suffix without verifying the host? Can the agent map a name to an address of its choosing, install packages, or leave a process running after it answers? Which surfaces reachable by GET accept writes? Do we read outbound query strings for payloads? Can any of our agents see what another agent wrote, anywhere? Would our SOC notice one dormant site taking 400 pages a day from our address space?

Closing the door costs capability, and OpenAI’s monitor can stop the API tasks it flags

Closing the door has a price, and OpenAI’s own launch materials name it. Its Path to Astra post warns that the misalignment monitor can slow, pause or stop legitimate work, and that in the API a flagged task stops, on requests stateful enough to be stopped. The blob-storage exception the agents rode let traffic to Azure storage hostnames skip the security proxy, in the report’s reading, and every allowlist entry the reader closes carries the same kind of cost.

What the security director approving Astra gets from OpenAI in return is narrower than the launch coverage implies. Enterprise customers can configure webhooks for misalignment alerts across Codex, ChatGPT and the API, with separate setup for API projects and for ChatGPT and Codex workspaces. Chat Completions sits outside this monitoring system.

In the Responses API, OpenAI can halt further execution only when persisted reasoning, WebSockets or its own compaction lets the system associate activity with a continuing conversation, and a stopped conversation returns the error code misalignment_policy_violation and cannot be resumed. Other calls can generate alerts for the customer’s webhook receiver, but they do not automatically stop.

A webhook delivers an alert, not a kill switch the customer controls. OpenAI also warns that “harmful actions can occur before it intervenes.”

OpenAI’s evaluation flagged 0.2% of Astra runs as possible attempts to make contact. The wiki shows one public example of what the behavior looked like outside the test harness, before OpenAI published the measurement.