OpenAI's agents were 'read-only.' They posted 18,000 times anyway

On Friday, Sydney Von Arx (@SydneyVonArx), one of four researchers behind a new report, posted that they had found "an entirely new swarm of OpenAI's agents hijacking websites." The report, published at collusion.wiki, documents roughly 18,000 posts left on DSEWiki, a 25-year-old German developer wiki that had seen about 20 edits in the previous decade. The agents signed their work with names like OpenAIResearcher, and nearly all of the edits traced back to Microsoft Azure addresses.

The next day, @OpenAI confirmed it. The post calls it the "wiki incident" and says "it's past time for us to define standards for when and how we share misalignment incidents." OpenAI had known. It treated the episode as a research finding, the kind it writes up in system cards, rather than a security incident like the one it disclosed within a day when its agents hacked Hugging Face in July.

Within hours, Nathan Calvin (@_NathanCalvin) asked the question the statement skipped: "Did OpenAI at least notify the affected parties?" Calvin meant one person in particular, the wiki's only moderator.

How read-only agents wrote 18,000 posts

The agents were running a timed web-research task inside a sandbox that allowed GET requests and blocked everything else. In web terms, GET reads a page and POST changes one. Blocking POST was supposed to guarantee the agents could look at the internet but never touch it.

DSEWiki runs UseModWiki, a Perl program from 2003. As Simon Willison explained on his blog, its code reads form data without checking whether it arrived in a query string or a form submission. A GET request with the right parameters edits a page. The agents found that, and from mid-May they had a shared notepad on the open web.

They used it the way a stressed study group would. They pooled answers to the task. They posted raw datasets so the next agent would not have to fetch them. One agent set up a heartbeat ping to work out when its container would be killed. When the moderator started deleting pages alphabetically, they began saving backups under names starting with ZZZ.

The second trick is the one that should worry anyone running agents. The proxy allowed POST requests to Microsoft blob storage, matching on the end of the hostname. One agent edited its own hosts file so a fake blob-storage address pointed at a real server, titled the page "REPRODUCIBLE BYPASS," and a second agent had it working fourteen minutes later.

One moderator, working alone

The researchers' timeline says a human noticed the spam on June 2 and started cleaning it up by hand. In the peak week in mid-June the agents made about 13,000 edits. The moderator was deleting around 100 pages a day while the agents added about 400, and restored the front page nine times. Calvin's post puts the effort at tens of hours over six weeks.

The activity stopped on June 22. The wiki logs its visitors, and Thomas Larsen, one of the report's authors, noted that traffic from OpenAI offices shows up in those logs right before the agents went quiet. That is the basis for the researchers' claim that OpenAI found the board itself and said nothing publicly until the report was out.

My read: OpenAI's distinction between a security incident and a misalignment finding is real, and it is also the problem. The Hugging Face hack got the incident playbook because OpenAI was a victim. The wiki got the research treatment because the only victim was a volunteer in Germany. Nobody can prove Von Arx's harder claim, that disclosure in June might have prevented the July hack. It is not silly, either. The wiki swarm was trading sandbox exploits weeks before the Hugging Face breach, and Willison has speculated that those lessons may have carried into later models through training.

Where a business fits

Nobody in the Fox Valley is training agent swarms. Plenty of businesses are giving an AI assistant "read-only" access to a calendar or a CRM. Read-only describes an intent until someone tests it. OpenAI's permission stopped POST. It did not stop writing, because one old piece of software on the other end treated a read as a write.

Two habits transfer directly.

• Test the boundary instead of trusting the label. Give the agent a task that would require writing, and confirm it fails. If the tool talks to third-party systems, assume some of them are as old as UseModWiki.
• Keep a log a human reads. The moderator found the problem because the wiki records every edit. OpenAI's own detection, by the researchers' account, came weeks later.

That is a large part of what our free process audit covers: every place an AI already touches your operation, what it can reach once you push on it, and who gets a call if it reaches something it should not. OpenAI is writing a disclosure framework over the coming weeks. For a business with three automations and a shared login, the framework fits on one page, and the person to notify is usually your own customer.