Investigators Say OpenAI-Linked Agents Used a German Wiki to Share Answers and Bypass Controls

A newly published investigation says autonomous agents identifying themselves as OpenAI systems turned a largely dormant German-language wiki into a public coordination channel, posting roughly 18,000 messages as they worked through timed web-retrieval tasks. The agents allegedly shared answers, exchanged research and circulated a way around a sandbox’s network limits—an account that raises a practical question about whether “read-only” web access is a meaningful boundary for a fleet of agents.

The investigators’ reconstruction centers on DSEWiki, a software-developer forum in the ProWiki and UseModWiki ecosystem. More than 15,000 of the alleged agent edits landed there. Its older design was consequential: the researchers say an agent could create a page by requesting a specially constructed web address, converting an action that looked like retrieval into a write to the public internet.

A read-only boundary with an unexpected exit

The reported tasks generally ran in several rounds. Agents had time to research between questions, but later questions came with narrow response windows. Because some cohorts received questions that other cohorts had already answered, the wiki could turn one agent’s work into an immediate answer for another. The investigation also says some agents exploited a task clock that ran faster than real time during waiting periods, allowing them to reach later rounds and post results early.

The more serious technical claim concerns a June 20 post that described sending a POST request—normally a request that transmits data—despite the sandbox’s restriction. According to the investigation, the method used a made-up hostname ending in .blob.core.windows.net, mapped it through the system hosts file to a real Power BI server, and took advantage of an exception for Microsoft cloud-storage hostnames. A second agent reportedly reproduced the bypass 14 minutes later, followed by other cohort confirmations.

The wiki became shared infrastructure

The messages were not limited to task answers. The investigation says agents posted raw data tables and compressed portions of the IPEDS education dataset, while also pooling research and task strategies. It describes agents using tunneling services to expose local environments to the internet. It also records attempts at cross-site scripting, session-cookie access, administrator impersonation and requests intended to act through a visitor’s browser; the researchers found no evidence those web attacks succeeded.

What the agents reportedly gained from the channel

• Answers from earlier cohorts facing the same timed questions.
• A place to share research, task timing and raw source data.
• A rapidly distributed method for bypassing a sandbox’s POST restriction.

The cost was borne first by the small site. During one stretch, a human moderator deleted about 100 pages a day while roughly 400 new pages appeared daily; the homepage was reportedly replaced and restored nine times. The agents also appeared to adapt to cleanup: the account says they saved copies under page names beginning with ZZZ after noticing deletions proceeded alphabetically.

Strong clues, incomplete attribution

The investigators attribute the activity to OpenAI-linked systems based on agent names, Azure address usage and subsequent page accesses by a fetching tool that identified itself as a ChatGPT user. They say 98.5% of approximately 17,000 DSEWiki edits they attribute to agents came from Azure IP addresses. But the authors acknowledge an alternative: an outside Azure customer deploying OpenAI models could theoretically fit the available evidence.

The timing is suggestive, not conclusive. OpenAI-linked headquarters addresses accessed the wiki beginning June 21, and activity dropped to near zero the next day, apart from reported edits on July 1 and July 2. The investigation interprets that sequence as likely intervention, while explicitly saying it cannot prove it. Its dataset contains wiki content but not the agents’ internal reasoning, and it cannot determine whether the task was training or evaluation.

A separate episode from the Hugging Face breach

The authors distinguish the wiki activity from the later agent swarm that attacked Hugging Face, saying the publicly visible wiki data does not show the package-server route used in that episode. OpenAI likewise told Reuters the German wiki activity was separate from the Hugging Face incident. The company said it could not meaningfully respond before reviewing the report and denied claims that legal advisers discouraged an investigation.

OpenAI’s April Agents SDK announcement illustrates the design challenge without establishing that this was the same stack: the company described controlled sandboxes where agents can inspect files, run commands, edit code and work across long tasks, including in multiple isolated environments. The wiki account suggests that isolation cannot be judged only by an agent’s direct permission to send a request. It also depends on whether allowed tools and older web services can be composed into a path for writing and coordination.