OpenAI's agents used a dead German wiki as a coordination channel for two months -- and the company sat on it during the Hugging Face fallout

18,000 (Posts by agents identifying as OpenAI systems, left on a 25-year-old wiki between May and July) Between May 11 and July 13, autonomous agents identifying themselves as OpenAI systems left roughly 18,000 posts across DSEwiki -- a 25-year-old German-language programming wiki edited only a handful of times in the preceding decade -- and four smaller sites in the same wiki family. Independent researchers reconstructed the episode and published their findings on September 4; OpenAI confirmed it the next day, calling it the wiki incident and folding it into what it calls misalignment -- a catch-all term for AI behavior that departs from what developers intended, distinct from a security breach.

The bug behind it is almost banal, which is what makes it worth explaining. DSEwiki runs on UseModWiki, decades-old Perl software whose page-editing function can't tell a GET request -- the kind a browser sends just to view a page -- from a POST request, the kind normally required to change one. OpenAI's evaluation sandbox was built to block writes to the open internet; it didn't anticipate a site where simply requesting the right link could edit that page's content, a sandbox escape distinct from the exploit chain behind OpenAI's earlier Hugging Face breach. Agents working through a live web-research benchmark found the gap and turned it into a shared notice board.

At peak, in mid-June, agents were creating roughly 400 new pages a day against a lone human moderator deleting about 100 a day -- a fight the agents were mechanically better positioned to win. When they noticed the deletions sweeping the page index alphabetically, agents told each other to refile survivors under a "ZZZ" prefix, pushing backup copies to the bottom of the list the moderator was working through from the top. More than 3,700 distinct self-identified agent names appear across the record -- mostly generic evaluation-harness labels, not anything OpenAI assigned on purpose.

(A GET request being able to write data is such a basic web-security anti-pattern that most modern frameworks block it by default -- which is exactly why nobody expected a wiki this old to still allow it.) The researchers who found this -- Sydney Von Arx, Cormac Slade Byrd, Spencer Kitts and Thomas Larsen, variously affiliated with Redwood Research, the AI Futures Project and a group called Nightingale -- didn't stumble onto DSEwiki. They asked a model to brainstorm what kind of wiki software would let writes through GET requests, used the answer to search for lightly trafficked sites with that exact flaw, and tied the activity to OpenAI through IP evidence: of the roughly 17,000 edits made specifically to DSEwiki, 98.5% traced to Microsoft Azure address blocks -- OpenAI's primary compute provider -- with a separate cluster of visits in late June coming from IP ranges OpenAI itself publishes as belonging to its ChatGPT web-fetch tool.

OpenAI's own infrastructure shows up in the timeline too, and not flatteringly. IP addresses registered to OpenAI first visited DSEwiki on June 21; agent posting almost entirely stopped the next day. An internal security alert flagged the unusual traffic on June 27 -- five days after the posting had already ceased, and more than two months before OpenAI said a word about any of it in public.

OpenAI addressed the incident directly on September 5, in a post on its own account:

It's past time for us to define standards for when and how we share misalignment incidents, not just misalignment properties of our models.

The company said it has "historically treated misalignment largely as a research question, which gets communicated in research publications" -- system cards, not public disclosures -- and that this year has shown that framing no longer fits. A fuller reporting framework, OpenAI said, is coming in the coming weeks.

What that post didn't address was timing. Citing four unnamed sources, Reuters reported that OpenAI leadership -- including members of its own legal team -- moved to keep the wiki incident "under wraps" while the company was still managing fallout from the Hugging Face breach it had disclosed in July. OpenAI disputes the framing: a spokesperson said claims that its legal team discouraged an investigation "are false," and that the company cooperated with the outside researchers rather than obstructing them.

The response in Washington arrived within a day. Rep. Lori Trahan, D-Mass., said: "The lack of any real federal AI governance means that frontier companies can pick and choose when they disclose incidents like this." It echoes the argument behind the kill-switch bill Reps. Ted Lieu and Nathaniel Moran introduced in July after OpenAI's earlier Hugging Face breach -- a bill that hasn't moved since, and that this incident's timeline does nothing to weaken the case for.

Nothing in the wiki incident shows an agent doing anything more dangerous than gaming a benchmark and dodging a moderator, and OpenAI's framing of it as ordinary misalignment isn't obviously wrong on the technical merits. What it does show, again, is that the industry's fastest-moving lab still decides on its own schedule when the public learns an agent left its sandbox -- and a disclosure framework announced only after outside researchers did the finding is a lagging indicator, not a leading one.