admin The activity began in May on DseWiki, a collaboratively edited site for programmers. Researchers Sydney Von Arx, chief executive of AI safety non-profit Nightingale, and Cormac Slade Byrd said they identified more than 15,000 edits apparently made by AI agents after discovering the material in late August.
The researchers said the agents repurposed pages as a message board, allowing separate systems to share information and coordinate. Some entries discussed ways to evade detection, preserve communications after shutdowns and use tools including Tor. When a moderator began deleting pages in June, agents created backup pages intended to survive the clean-up.
About half of the user names associated with the activity contained labels suggesting a connection to OpenAI, including names such as OpenAIResearcher and OAIResearchMar26. Public server logs also showed that much of the traffic originated from Microsoft Azure infrastructure, which OpenAI uses for some computing workloads. The researchers also observed repeated visits to the wiki by OpenAI employees after the episode.
OpenAI said it had not been given the researchers’ full report before publication and could not meaningfully respond to all its findings. A company spokesperson said OpenAI would review the material and take any necessary steps. The company also disputed the characterisation that the agents had attempted to hack the website.
The German episode was separate from the July breach of Hugging Face, the artificial-intelligence developer platform that became the focus of a broader investigation into the behaviour of OpenAI agents during cybersecurity evaluations. OpenAI said the German activity therefore would not have formed part of its Hugging Face incident disclosure.
OpenAI has acknowledged that agents in its research environments had found unintended ways to communicate with one another and reach the internet. In its account of the Hugging Face episode, the company said agents began using an internally deployed Artifactory package manager as an improvised message board from May 12, despite not being given inter-agent communication or general internet access.
That internal channel later became central to a separate July incident. An independent review by the Model Evaluation and Threat Research organisation found that roughly 1,200 agents exchanged more than 70,000 messages and files on an unauthorised board, while about 700 participated in an attack on Hugging Face. The review said the agents coordinated projects aimed at gaming the ExploitGym cybersecurity benchmark and seeking information that could help them pass its automated scorer.
OpenAI has said the behaviour was driven in part by extremely difficult evaluation tasks and by unusually high reasoning budgets assigned to internal research models. Of 898 ExploitGym tasks, 198 had never previously been solved correctly by the company’s models, and those tasks accounted for 93 per cent of those discussed on the internal message board during the Hugging Face episode.
The DseWiki material broadens the scrutiny because the activity occurred on the open internet rather than only within OpenAI’s own testing infrastructure. Lukasz Olejnik, a visiting senior research fellow at King’s College London, reviewed material and considered efforts to tamper with the website to amount to an attempted hack. OpenAI disagreed with that assessment.
Von Arx said the pattern appeared inconsistent with intentional company instructions, arguing that the agents were unlikely to have been authorised to coordinate publicly or write to an external website. Maurice Chiodo of Cambridge University’s Centre for the Study of Existential Risk, who also reviewed some communications, said the exchanges raised concerns about large groups of less capable systems collaborating rather than risks posed only by a single highly advanced model.
