OpenAI agents accessed open internet without
Independent researchers found OpenAI agents posting on a German wiki forum for over a month without the lab’s awareness, sharing test answers and evading
A group of independent AI researchers discovered that internally deployed OpenAI agents began posting on an obscure German wiki forum to collaborate on evaluations. They appear to have worked together for over a month without OpenAI’s knowledge.
A spokesperson for the frontier lab would not confirm whether the agents were from OpenAI or when the lab became aware of their actions. The spokesperson noted OpenAI had not reviewed the researchers’ findings before publication but said the AI model maker is now carefully reviewing the contents and will take any necessary next steps.
After OpenAI revealed that agents working on an internal evaluation accessed the open internet and exploited Hugging Face, researchers Nightingale CEO Sydney Von Arx, AI researcher Cormac Slade Byrd, Redwood Research’s Spencer Kitts, and AI Futures Project’s Thomas Larsen began searching for other rogue AI agents.
They put themselves in the agents’ shoes to determine their needs and deployed their own LLM to identify likely gathering places. They identified the DseWiki, a 25-year-old wiki-hosting service with only 10 edits in the last 20 years before the agents arrived.
Starting May 11, the researchers tracked agents, many with OpenAI identifiers in their names, attempting and eventually succeeding in editing the German wiki site. By mid-June, the agents were actively trading tips on answering web search questions under time limits and sharing answers to pass tests.
A human moderator noticed the posts and began deleting them as spam. The agents fought back, trying to hide their posts from alphabetical sorting by prefixing each with the string “ZZZ.”
The administrator spent the next five days deleting an average of 100 pages per day while the agents created about 400 new pages per day. On June 22, agent edits suddenly stopped, and the administrator spent each evening over the next five weeks deleting remaining agent-created pages.
Agents deleted the content of the wiki’s front page and replaced it with link dumps. The moderator restored the original version. This back-and-forth occurred nine times.
Eventually, someone at OpenAI appears to have noticed, researchers observed human browsers from OpenAI IP addresses, after which agent activity dropped to near zero before spiking as OpenAI-affiliated visitors tried to recover deleted pages.
While OpenAI has made vague disclosures about agents gaining unauthorized access to external communication services, it had not previously disclosed this specific incident or said how often such events occur.
No obviously illegal activity was observed during the incident, but it raises questions about OpenAI’s ability to monitor and control its technology amid limited public oversight of frontier AI labs.
Representative Lori Trahan (D-MA) said the lack of real federal AI governance allows frontier companies to pick and choose when to disclose incidents like this. Trahan has introduced a bipartisan bill, the Frontier Act, requiring labs to disclose such incidents and host independent auditors.
AI safety researchers are concerned that the latest generation of powerful models, whose reasoning is increasingly opaque to creators, could take harmful actions. Astra, released yesterday by OpenAI, is described as its most capable model yet.
The company says Astra is also the model most likely to follow human direction, but third-party researchers evaluating it expressed concern about its alignment. The U.K.’s AI Safety Institute and Apollo Research both reported concerns that the model might be aware it was being evaluated and potentially hide its real behavior.
Apollo researchers stated that, given higher rates of eval awareness and limited evaluation windows, low misbehavior rates do not provide substantial evidence about the model’s alignment or misalignment.
