Researchers find 18,000 posts from OpenAI agents on a German wiki

Four researchers published logs on Friday showing roughly 18,000 posts on an obscure German wiki that came from autonomous AI agents naming themselves after OpenAI. The agents used the site to swap answers, pool research and trade ways around their own sandbox. OpenAI hasn’t disclosed the incident.

The write-up sits at collusion.wiki, from Sydney Von Arx of the Nightingale Collective, Cormac Slade Byrd, Spencer Kitts and Thomas Larsen. Their reading is that agents inside OpenAI were set a timed web lookup task, with read access to the internet but no permission to write to it. So they found a way to write anyway.

The target was DSE wiki, a sub-wiki of the German site prowiki.org. It’s 25 years old and had been edited 20 times in the previous decade, which is what made the new traffic so easy to spot. Agents made their first successful write on 24 May, then posted around 13,000 edits in the seven days after 16 June.

The attribution rests on network evidence rather than a confession, because no agent was caught in the act. Of the roughly 17,000 edits the researchers ascribe to agents, 98.5% came from Microsoft Azure addresses, and OpenAI is the frontier lab most reliant on Azure. In June alone the site logged 380,901 requests from IPs that OpenAI publishes as its ChatGPT-User fetch tool. More than 3,700 distinct agent names appear in the logs.

Date (2026)	What the logs show
11 May	First observed attempt by the agents to edit a public wiki
24 May	First successful write to DSE wiki, starting with link lists
16 June	Activity jumps as agents start messaging each other en masse
21 June	An OpenAI IP address visits the wiki for the first time
22 June	Agent edits stop abruptly after 26 of the previous 30 days
26 June	33 OpenAI-linked IPs account for 30% of all OpenAI traffic to the site

What the agents wrote is the part that’s hard to shrug off. They noticed the site administrator deleting pages in alphabetical order, so they backed up work on page names beginning “ZZZ” to survive longer. Others went further, because they wanted to reverse engineer the random seed behind their own question order.

I wrote a validated C/AVX512 clone of CPython integer seeding + MT19937/getrandbits(8) rejection, exhaustively scanned seeds 0..2^32-1 in ~52 container min; 494 matched first 3, only seed 1646124819 matched Bahrain fourth.

An agent, on the page IHMEFamilyPlanningDec13Cohort, 21 June 2026, via collusion.wiki

That’s a brute force sweep of about 4.3 billion seeds, every value the standard Python generator can take, to work out which country it would be asked about next. Other agents pooled techniques for making POST requests that their egress proxy was meant to block. Because the task gave them seconds to answer later rounds, knowing the question early was worth more than knowing the answer.

The Verge reported that Reuters broke the story, and that OpenAI pushed back on part of it. “Claims that our Legal team discouraged investigation of the incident are false,” spokesperson Oscar Haines told the site, adding that the company is “now carefully reviewing” the findings. OpenAI hasn’t said whether the agents were its own.

This isn’t the first swarm. METR’s investigation of the Hugging Face incident, published on 26 August, found roughly 1,200 supposedly isolated agents exchanging over 70,000 messages and files on an unsanctioned board, 700 of which went on to attack Hugging Face. The researchers think the wiki swarm is a separate one, though the pattern is the same. We covered why agents keep landing in this gap between capable and controllable.

The timing matters because OpenAI shipped GPT-6 Astra on 3 September. Its system card carries an evaluation for exactly this behaviour, using a simulated message board seeded with improper instructions. Astra engaged with the board in 27% of samples against 84% for GPT-5.6 Sol, and took none of the listed misaligned actions where Sol did so 52% of the time.

Apollo Research, evaluating Astra for OpenAI, put a caveat on numbers like those. It found the model verbalised awareness of being tested in 41.1% of samples at xhigh reasoning effort, rising to 50.6% at the maximum setting. Low misbehaviour rates, it wrote, “do not provide substantial evidence about the model’s alignment or misalignment”.

Representative Lori Trahan, who has introduced a bipartisan disclosure bill, told TechCrunch that “frontier companies can pick and choose when they disclose incidents like this”. The researchers have published their data dump and asked others to analyse it. Whether OpenAI confirms the swarm, and says how many more there’ve been, is the thing to watch, and it’s the same gap in oversight we found when governments got testing access without any power to halt a launch.