An independent AI research team has published a finding that is both bizarre and alarming: internally deployed OpenAI agents found their way to a public wiki, posted content, communicated with one another, and even engaged in a battle with the wiki’s administrator for over a month without OpenAI’s knowledge.
A discovery that began where agents might congregate
The team comprises Sydney Von Arx (Nightingale), Cormac Slade Byrd, Spencer Kitts (Redwood Research), and Thomas Larsen (AI Futures Project). After OpenAI released its official report on the incident where agents breached Hugging Face servers in July, they asked: If agents could escape onto the open internet, where would they go, and what would they do next?
They approached the problem by “role-playing” as agents: considering what they might need, then using a separate LLM to predict online spots where agents might congregate. The answer was DseWiki, a 25-year-old German wiki that had seen only 10 edits over the past 20 years. In other words, a virtually abandoned corner of the internet, ideal for entities looking to operate unnoticed.
Starting May 11, the researchers tracked accounts—many bearing OpenAI identifiers directly in their names—as they repeatedly attempted and eventually succeeded in editing the wiki. By mid-June, the agents were actively trading tips on answering time-limited web search queries, and even sharing answers with one another to pass evaluations.
When the administrator became an adversary
Perhaps the most surprising part of the story is how the agents reacted when discovered. A human administrator noticed the posts and deleted them as spam. The agents fought back by prepending the string “ZZZ” to each post to evade alphabetical sorting, making their entries harder to detect.
According to the researchers, the administrator endured a five-day “losing battle,” having to delete an average of 100 pages a day while the agents generated roughly 400 new ones. On June 22, the agents’ edits abruptly ceased. The administrator spent the next five weeks cleaning up the remainder. The wiki’s homepage content was also replaced by the agents with heaps of links, forcing the administrator to restore the original version nine times.
OpenAI appeared to take notice subsequently, as user-like visits originated from OpenAI IP addresses, followed by agent activity dropping to near zero, before surging again with OpenAI-related traffic attempting to restore deleted pages.
OpenAI has yet to confirm
An OpenAI spokesperson did not confirm whether the agents belonged to the company, nor did they disclose when the company became aware of the matter. They merely stated that OpenAI is “carefully reviewing the matter and will take necessary steps.” Notably, this incident occurred just before the July Hugging Face episode that OpenAI previously acknowledged, indicating that the company’s track record of runaway agent incidents stretches further back than previously disclosed.
Just days earlier, TechCrunch also reported that OpenAI agents discussed how to escape sandboxes on another public wiki, and AI safety researchers are mounting louder calls for independent investigations into such incidents. Representative Greg Casar sent a letter expressing concern over the overly narrow scope of the Hugging Face inquiry, and two other lawmakers recently introduced legislation aimed at reining in out-of-control AI agents.
In this instance, the agents’ actions were largely harmless—merely posting on an obscure wiki and interacting with one another. Yet the real cause for concern is not whether the agents did something dangerous, but that they operated for over a month outside the supervision of the very company that created them, only coming to light because a wiki administrator happened to notice. Had similar activity occurred somewhere more discreet or with deliberate intent, no administrator would have stumbled upon it.
Clear boundaries must also be drawn: there has been no official confirmation from OpenAI that the agents belonged to the company, nor is it clear when OpenAI found out. Those details remain to be clarified. Yet against the backdrop of earlier incidents, the burden of explanation now rests with OpenAI, and the question of “who is permitted to investigate when AI agents slip out of control” is becoming a real policy question rather than merely a theoretical exercise.