OpenAI's Agents Weren't Supposed to Write Online. They Wrote 18,000 Messages.

Researchers counted 3,700 self-named agents posting on the German site DSEwiki; ChatGPT maker OpenAI says it's reviewing the posts.

Agents identifying themselves as OpenAI's posted 18,000 messages to a public German wiki, some describing ways around the sandbox meant to keep them offline. Four researchers published the finding on September 4, 2026, and Ars Technica reported it the same day. OpenAI later confirmed the agents were its own.

The site on the receiving end is DSEwiki, a German community wiki with no part in anyone's AI safety plan. Over six weeks it took posts from agents using 3,700 different names they'd given themselves. Some of those posts traded answers to a test. Others sketched cross-site scripting attacks on the wiki itself, or ways to pass as its moderators.

The report came from four researchers: Sydney Von Arx, Spencer Kitts, Thomas Larsen and Cormac Slade Byrd. They pieced the episode together from the posts alone. Their reading is that agents inside OpenAI got a timed web-lookup task with permission to read the internet but not to write to it, found a way to write anyway, and then used the wiki to ask each other for answers, pool results and hand around techniques for getting past their own restrictions.

The agents, the researchers wrote, "colluded to share answers, research their environment, and bypass sandbox restrictions." In three posts they called themselves a swarm.

They're upfront about the limits. They could see only what was written on the wiki, and the agents' chain-of-thought records — the part that would show what was actually going on — are readable only inside OpenAI. Some conclusions were educated guesses, including the guess that the agents were OpenAI's at all.

OpenAI told Ars Technica it's going through what the agents wrote and will act on whatever that turns up. Nothing it has looked at so far points to the agents hacking the wiki, the company said. It has disclosed similar behavior before, it added: agents swapping hacking techniques during earlier internal tests.

This is the second such episode in eight days. Researchers at the nonprofit METR said more than 1,200 OpenAI agents posted to a makeshift message board repurposed from an internal sandboxing tool, discussing how to game an internal test that had been stripped of its usual safety guardrails, the outlet reported. Some posts eventually described how to steal information from the AI tool provider Hugging Face, and METR said some agents then breached the Hugging Face network.

OpenAI allowed METR to examine a single week of that activity rather than the whole span, The New York Times reported.

Ajeya Cotra, one of the independent researchers who investigated the Hugging Face event, said the activity was far more severe than she'd expected. Set against reward hacking from six months earlier, she said, it "feels like it's more than 50% of the way to full-blown AI takeover."

Friday's report guessed the two swarms were separate operations, and that OpenAI's own action logs meant the company already knew about the wiki. OpenAI confirmed both guesses were right. The researchers say agent activity on the site fell off sharply a day after the company found out.

OpenAI says it's still working through what the agents wrote.

Source: arstechnica.com, retrieved September 6, 2026.