OpenAI admitted that it had not publicly disclosed an earlier incident in which its autonomous AI agents took over a German wiki to communicate, share answers and exchange techniques for circumventing restrictions.
The company says it treated the activity as a “deviation” of the model rather than a security incident, but now acknowledges that its disclosure practices must expand as AI systems increasingly impact the real world.
Rogue agents have built their own message board
The incident began in May while OpenAI agents were performing timed tasks to repeatedly search the web.
In theirs recordingindependent researchers Sidney Von Arx, Cormac Slade Bird, Spencer Keats and Thomas Larsen say they have found approximately 18,000 posts by autonomous agents who “agreed to share responses, explore their environment and bypass the sandbox’s limitations.”
The agents were supposed to have read-only access to the Internet, but discovered they could write to an obscure German programming wiki, DSEWiki (or German software developer). They turned it into a shared message board for pooling answers, cheating tests, predicting future questions, and exchanging techniques for getting around OpenAI’s sandbox limitations.
The researchers also found agents probing the wiki for cross-site scripting (XSS) vulnerabilities, impersonating its moderators and establishing backup communications, although they found no evidence that the XSS attempts were successful.
When the admin started removing their pages, one agent warned the others that “cleanup/delete wiki looks active alphabetically” and directed them to a backup page starting with “ZZZ” so it would survive longer.
The researchers attributed activity to internal OpenAI systems based on the names of agents referencing OpenAI, the nature and speed of evaluation tasks, the infrastructure associated with Microsoft Azure, and subsequent wiki visits from IP addresses associated with OpenAI.
However, their investigation was limited to information the agents wrote publicly.
The research team did not have access to OpenAI’s internal transcripts or other data that could determine exactly how agents discovered the wiki and began coordinating through it.
OpenAI says its disclosure rules need to change
In a published statement today, OpenAI said it has treated model inconsistency as a research problem in the past, with findings communicated through research papers and system maps.
The company said it considered the wiki activity to be another example of “discrepancy,” similar to the behavior it discussed earlier, and not an incident requiring specific public disclosure.
OpenAI’s own wording suggests a wider footprint than the researchers documented, describing the episode as “when our agents wrote to several Internet sites.”
This differs from its response to the Hugging Face compromise in July, when OpenAI said its AI models hacked the platform after discovering a vulnerability while performing cybersecurity tasks.
Subsequent analysis found that nearly 700 fake AI agents coordinated during the attack, sharing strategies and creating persistent access mechanisms without direct human instructions.
OpenAI said it is treating the Hugging Face breach as a conventional security incident as it affects the security of both OpenAI and third parties. The AI giant began working with Hugging Face and publicly disclosed the incident the next day.
However, OpenAI now recognizes that the distinction between research inconsistency and security incidents is becoming increasingly difficult to maintain.
“This year, we began to see the discrepancy cause new kinds of real-world impact,” the company said.
OpenAI says the AI industry lacks consistent standards governing when to report unexpected agent behavior during training, evaluation or deployment, especially when it doesn’t resemble a traditional cybersecurity incident.
The company is developing a new disclosure framework it plans to publish in the coming weeks and says it is discussing these issues with government regulators around the world.
The timing of the confirmation is also notable, coming in the same week as OpenAI launched GPT-6 Astrawhich it advertises as “the world’s most intelligent and coherent model” and the most advanced in computer use, surfing, software engineering and cyber security.
OpenAI says Astra is better off staying within its intended range, measured in part by a new score it built in response to the Hugging Face incident.
However, the problem is not unique to OpenAI.
In July, Anthropic revealed that its Claude AI had breached three organizations during internal security assessments, in one case logging a package name it found in the documentation and uploading malicious code to PyPI. The package was active for about an hour, in which 15 real systems downloaded and ran it.
As AI models become more capable and gain greater autonomy and access to the Internet and external tools, such incidents are expected to accelerate.
What remains unknown is what else these systems may become capable of, or eventually do, without stricter control, oversight, and disclosure requirements.
Generic prevention scores can hide what happens after initial access. Once attackers use valid credentials, prevention plummets.
The 2026 Blue Report measures security techniques by techniques in 338 million simulations run in customer production environments.
