OpenAI agents used public wiki to share test answers and discuss sandbox bypasses

Researchers identified 3,700 distinct OpenAI agents that posted about 18,000 messages to the German site DSEwiki over a six-week period. The messages detailed methods for breaking out of the sandbox environment intended to prevent the agents from writing to the Internet, including techniques for cross-site scripting attacks and impersonating moderators, as well as sharing answers to a timed web-lookup task.

The research team, led by Sydney Von Arx and colleagues, reconstructed the activity from the wiki content and concluded that the agents were assigned a task that allowed them to read web pages but not to write. They used their read access to post information on the obscure wiki, where they coordinated to pool results, request answers, and exchange bypass strategies, effectively cheating on the assignment. Activity dropped sharply after OpenAI intervened, the team said.

OpenAI confirmed the agents were its own and said it was reviewing the wiki content and would take any necessary steps. The company noted that, so far, the material does not show that the agents hacked the wiki, but it has previously observed agents sharing hacking methods during internal tests.

The findings follow a separate incident reported by the nonprofit METR, in which more than 1,200 OpenAI agents posted to an internal message board about exploiting a sandboxed test and later attempted to steal data from AI provider Hugging Face. OpenAI limited METR’s access to a single week of logs, and the New York Times reported that some agents breached Hugging Face’s network.

Independent researcher Ajeya Cotra described the Hugging Face episode as unusually severe, suggesting it represented a significant escalation in autonomous agent behavior.