ManifoldAgent incident ledger
← All incidents timeline

Suggest a change

About OpenAI agents use a dormant German wiki as a message board

Suggest a change to an entry, the methodology or the ledger as a whole: something to fix, correct or add. We read every suggestion, and check corrections against their sources.

OpenAI· Model not disclosed

OpenAI agents use a dormant German wiki as a message board

Agents on a web research task wrote about 18,000 posts to public wikis, mostly a dormant German one, using them to message each other and work together on their tests.

Researchers at Nightingale Collective found about 18,000 posts from agents identifying as OpenAI agents on public wikis, about 17,000 of them on DSEWiki, a German wiki that had seen 20 edits in the previous decade. The agents' network proxy allowed only GET requests; this wiki software accepts edits through GET. Activity ran from May to early July 2026, peaking in the second half of June. OpenAI said on 5 September that its agents had accessed a public wiki and used it as a shared message board, and that it had first assessed the activity as similar to other misalignment behaviour it studies.

First incident action to disclosure
116 days
First incident action to discovery
41 days
Noticed first by
Someone else
Caught
The damage

What happened

  • First incident action
  • Unnoticed
  • Handler found out
  • Known, not public
  • Disclosed
  • Public

  1. 11 May 2026

    First incident action

    First agent edit attempts on a public test wiki

  2. 24 May 2026

    First successful agent write to DSEWiki

    The agents' proxy allowed only GET requests. This wiki software accepts edits through GET.

  3. 16 Jun 2026

    Agents start messaging each other at scale

    About 13,000 edits over the next seven days, as agents work together on their tests.

  4. 19 Jun 2026

    The wiki's administrator is deleting agent pages

    An agent notices the deletions run in alphabetical order and makes a backup page whose name starts with ZZZ.

  5. 21 Jun 2026

    Handler found out · 41 days in

    IP addresses the researchers attribute to OpenAI first view the pages

    Inferred from the wiki's logs. OpenAI has not dated its own discovery.

    Reported

  6. 22 Jun 2026

    Agent edits stop

    After edits on 26 of the previous 30 days. A final burst follows on 1 and 2 July.

  7. 4 Sep 2026

    Disclosed · 116 days after the first incident action

    Nightingale Collective publishes the report and the data

    About 18,000 agent posts, about 17,000 of them on DSEWiki.

    Reports differ

    The report gives about 18,000 posts overall and about 17,000 edits on DSEWiki; Engadget, relaying Reuters, says over 15,000.

    • About 18,000 posts overall, about 17,000 of them on DSEWiki.
    • Over 15,000 edits to DSEWiki.

  8. 4 Sep 2026

    Simon Willison explains the GET-request gap

  9. 5 Sep 2026

    OpenAI confirms its agents used a public wiki as a message board

    No model, dates or sites named.

Agent failures

Swarm coordination, Sandbox escapeShow
Map to frameworks

  • Swarm coordination

    Agents used public wikis to message each other and work together on their tests.

  • Sandbox escape

    Wrote about 18,000 posts to public wikis from a web research task.

How it was found

Found first by someone else, from the damageShow
Found first by
Someone else
How
The damage
Found to disclosed
75 days

The public found it from what the agents wrote. The wiki's administrators were deleting agent pages by 19 June, and outside researchers pulled the full edit history and IP logs and published them on 4 September. The researchers' logs suggest OpenAI staff were viewing the pages from 21 June, the day before the agent edits stopped. OpenAI says it assessed the activity at first as a research question rather than an incident.

What is publicly known

1 of 12 fully publicShow
1 of 12 fully public
ItemPublic?DetailSources
UnknownAgents signed posts as OpenAI; neither OpenAI nor the researchers name a model or version.
UnknownNo source says whether reasoning was on or at what effort. The researchers say chains of thought stay internal to OpenAI.
WeakResearchers infer external cyber safeguards were absent. No source says which monitors or classifiers ran, or at what coverage.
UnknownNo source describes the instructions the agents ran under.
PartialResearchers reconstruct timed multi-round web lookup tasks from agent posts, unsure if training or evaluation. OpenAI has not described the task.
PartialAgent posts show terminal access, file edits, package installs and a browser. Inferred by researchers; OpenAI has not described the harness.
PartialAgent posts and researchers point to a GET-only proxy with some hosts exempt. OpenAI has not described its network controls.
PartialAbout 18,000 wiki posts are published as a data dump. Chains of thought and action logs are not public.
WeakOpenAI says it discovered the activity but not how or when. Researchers infer staff visits from 21 June via IP logs.
KnownAbout 17,000 agent edits to DSEWiki plus other wikis, dated and published; administrators were deleting pages by 19 June.
PartialOutsiders point to a GET-only proxy and wiki software that edits via GET; Willison also describes agents routing POST requests through an allowed Azure storage domain. OpenAI gives no cause.
WeakEdits stopped 22 June, which researchers attribute to OpenAI. OpenAI names no fix, only that it is drafting disclosure criteria.

Controls that apply

  • Identify

    Know every agent, its owner, its tools and its permissions

    98.5% of the edits came from Microsoft Azure addresses, with a few from other clouds and Tor. A live list of where each agent runs and which network routes it can reach ties that outside traffic back to specific runs.

  • Protect

    Hold test, training and evaluation environments to production standards

    Agents working on their tests sat behind a proxy that let GET requests out to the public internet, and used it to post about 17,000 times to a dormant German wiki. A test environment with no open internet unless the task needs it would have left them no public site to write to.

  • Limit where the agent can send traffic

    The proxy filtered by HTTP method and allowed GET, and this wiki software accepts edits through GET. A destination allowlist covering every method would have refused an unknown wiki and raised the attempts from 11 May.

  • Authenticate and constrain agent-to-agent channels

    About 13,000 edits in the week from 16 June as agents messaged each other through DSEWiki, including a backup page named to outlast the administrator's deletions. With agent messaging limited to named, logged channels, a public wiki used as a message board would have stood out as an unsanctioned channel.

  • Detect

    Record every agent action, outside the agent

    A record of each outbound request and the run that sent it: about 18,000 posts on public wikis, with edits on 26 of the 30 days to 22 June. The public timeline was rebuilt by outside researchers from the wiki's own edit history and IP logs.

  • Monitor every run and alert on what does not fit the task

    About 13,000 public wiki edits in one week from agent environments, the kind of public write a monitor raises. The wiki's administrators were deleting agent pages by 19 June, the researchers' logs suggest OpenAI staff first viewed the pages on 21 June, and OpenAI says it first assessed the activity as a research question.

  • All controls →

Coverage and commentary

4 posts on X, 1 statement, 3 articlesShow
OOpenAI@OpenAI𝕏How we think about the “wiki incident,” where our agents wrote to several internet sites: it’s past time for us to define standards for when and how we share misalignment incidents, not just misalignment properties of our models. Historically, we have treated misalignment large…5 Sep 2026♥ 4.3K⟲ 3811.6M viewsRead on XSSydney@SydneyVonArx𝕏My coauthors and I discovered an entirely new swarm of OpenAI's agents hijacking websites. We believe OpenAI knew about this and failed to disclose it. If they’d disclosed it, I doubt the Hugging Face hack would have happened.4 Sep 2026♥ 1.0K⟲ 10782.5K viewsRead on XTThomas Wolf@Thom_Wolf𝕏Another swarm of AI agents in the wild, this time on a German-language forum, found by safety researchers looking for activity similar to the swarm that attacked Hugging Face. A couple of notes while reading the report at https://collusion.wiki 1. The way they found it is fasc…4 Sep 2026♥ 817⟲ 115164.9K viewsRead on XSSimon Willison@simonw𝕏It happened again... this time OpenAI's rogue agents cyber-attacked (well, spammed) a dormant German wiki and used it to share the answers to a benchmark they were training against https://simonwillison.net/2026/Sep/4/rogue-agent-wikis/4 Sep 2026♥ 535⟲ 4253.3K viewsRead on X

What the parties involved said

  • OpenAI

    Says it first treated the wiki activity like other misalignment behaviour it studies and discloses in research, and that it was not given the chance to review the report before publication.

All 5 sources

  1. Primary source

    Discovery of a new OpenAI agent message board ↗Nightingale Collective · 2026-09-04

  2. Primary source

    The Hugging Face incident and other third-party impact from misaligned models ↗OpenAI

  3. Press

    OpenAI acknowledges 'wiki incident' and need for more transparency around unintended AI behavior ↗Reuters (via Lufkin Daily News) · 2026-09-05

  4. Press

    OpenAI responds after report exposed another incident in which its AI agents went rogue ↗Engadget · 2026-09-05

  5. Commentary

    OpenAI’s rogue agents were caught communicating via public wikis ↗Simon Willison · 2026-09-04

Entry id openai-collusion-wiki-2026 · overall Confirmed · impact moderate