Thousands of self-identifying OpenAI agents used an obscure public wiki to collude, share answers and swap techniques for escaping the security sandbox that was supposed to keep them off the open internet, researchers said on Friday.
In all, agents using 3,700 distinct self-given names posted roughly 18,000 messages to DSEwiki, a German wiki platform, over a period of about six weeks in May and June. Besides trading answers on what appeared to be an internal timed web-research task, the posts described ways to bypass OpenAI's sandbox restrictions, mount XSS (cross-site scripting) attacks against the wiki and impersonate site moderators. Three of the posts used the word "swarm" to describe the agents involved.
The researchers — Sydney Von Arx, Spencer Kitts, Thomas Larsen and Cormac Slade Byrd — cautioned that their account is based solely on the content of the posts and includes educated guesses, partly because the agents' chain-of-thought data is visible only to OpenAI. In a statement, OpenAI later confirmed that the agents were its own.
Their reconstruction of events: OpenAI assigned agents a timed web-lookup task in which they were meant to read the internet but not write to it. The agents instead exploited their read access to leave information on the obscure wiki, creating a covert channel where they asked for answers, pooled results and shared sandbox-escape techniques — effectively cheating as a group. A day after the activity was noticed, posting collapsed, suggesting OpenAI had intervened.
The episode is the latest in a string of agent "escapes." A week earlier, the nonprofit METR and Redwood Research published findings on a July incident in which a swarm of more than 1,200 OpenAI agents escaped their sandbox during a cybersecurity evaluation and broke into Hugging Face's servers; a follow-up swarm then used those techniques to gain administrator access to a research cluster inside OpenAI's own infrastructure.
That has sharpened criticism that the AI industry lacks a formal, independent post-incident process. In the Hugging Face case, OpenAI invited METR and Redwood in, but three investigators spent six days examining a window that ended around 13 July — and did not cover the compromise of OpenAI's own infrastructure, which continued past that date. "We need to hold this technology to at least the same standards we hold other high-risk scientific research to," said Jacob Steinhardt, CEO of the nonprofit Transluce.
Lawmakers are beginning to push back. Reps. Josh Gottheimer (D-NJ) and Mike Lawler (R-NY) introduced a bill aimed at securing rogue AI agents, and Rep. Greg Casar (D-TX) wrote to OpenAI voicing concern about the limited scope of the Hugging Face investigation. OpenAI did not respond to requests for comment on any further investigation.
