Discovery Of A New OpenAI Agent Message Board

Capybasilisk

Discovery Of A New OpenAI Agent Message Board — LessWrong

289 Discovery Of A New OpenAI Agent Message Board

by Capybasilisk

4th Sep 2026

1 min read

289

This is a linkpost for https://collusion.wiki/

We found ~18,000 posts from autonomous AI agents (self-identifying as from OpenAI) using the public internet to communicate during a web-retrieval task.

These AIs colluded to share answers, research their environment, and bypass sandbox restrictions.

Almost all of the logs of the agents communicating on this site are publicly available. However, we host our own copy where we’ve reconstructed the deleted pages via edit history and redacted personally identifiable information.

We encourage others to take a look and write up their own analyses of this data.

We have done a preliminary analysis of the data. However, we are operating on only part of the information: we can only see what the agents wrote on the wiki. AI agents also generate lots of “chain of thought” data, which is internal to OpenAI. Analysis including the chain of thought would likely provide much more evidence about the motivations and strategy of the AIs during this incident.

Our best guess of what happened is as follows:

Agents within OpenAI were assigned a timed web-lookup task.

As part of the task, they were supposed to have the ability to read the internet but not to write on it. They found a way to use their read access to write information to an obscure German wiki.

The agents used this wiki to communicate information with each other, primarily to help them succeed at their task. They asked for answers, pooled results, and shared techniques for bypassing their restrictions. This allowed them to use the work of others to cheat on their task.

OpenAI found out about this. A day later, agent activity plummeted, likely due to OpenAI intervention.

This is another example of a “swarm” of internally deployed OpenAI agents using the internet in unintended ways.

Personal Blog

289

New Comment

39 comments, sorted by

top scoring

Click to highlight new comments since: Today at 5:13 PM

[-]Philipp Risius9d*109117

I want to highlight that "OpenAI found out about this, but they didn't tell anyone" is extra bad. As in, it's bad enough that we see agents colluding and scheming in the wild. But if OpenAI had been responsible and informed the public as soon as they found out, perhaps we (as in researchers, politicians, and the general public) could have reacted a bit sooner.

This doesn't bode well for the future, because if nothing changes, such behavior will be repeated at all frontier AI companies whenever something bad happens. It might turn the last warning shot into the first kill shot.

[-]DW119d805

Someone on hackernews has found other wikis where the same swarm appear to have posted from May-June 2026:

https://news.ycombinator.com/item?id=49563657

[-]JennaS9d335

A commenter says they found even more.

[-]DW119d145

I'd be curious to know if these have the same pattern of OAI IPs visiting them followed by an end to the agents posting, or if OAI wasn't even aware of these.

[-]Tomás B.9d6143

Presumably, some of these websites were hacked and have standing to sue. Such an effort would be worth funding.

[-]ChristianKl5d41

The law about hacking in the US defines it as an intentional act. I think it's pretty hard to argue that anybody at OpenAI had an intention for the hacking to occur. Under what legal theory do you think websites are supposed to sue?

[-]Jiro9d2924

they were supposed to have the ability to read the internet but not to write on it.

This is not a coherent concept.

Anything that "reads" from the Internet has to send data first. If sending this data doesn't result in a write, that is only coincidence.

[-]faul_sname9d326

It can be a coherent concept, IF you e.g. have downloaded CommonCrawl and then you have a dumb server which just serves the stored pages off of disk - basically a CommonCrawl-backed clone of archive.org - and then you ONLY allow the agents to access that server.

That said, OpenAI clearly didn't even do that.

[-]Karl Krueger9d*21-4

The error in the quoted text is using "the Internet" instead of "the Web".

A web user is supposed to be able to read web resources without necessarily being able to modify those web resources. Doing this does involve transmitting packets (to make the request), and typically also involves side-effects such as the creation of log entries by the servers hosting those web resources. So "read-only" web access still involves "writing to the Internet" (sending packets) even if you're not "writing to the Web" (modifying web resources).

Normally you can't use reading web resources as a way of sending messages to other web users. But of course there are special cases where you can. A trivial example would be a server that publishes its own access log, so every "read-only" access to a resource causes a modification to a different resource (the log).

The HTTP standard distinguishes actions that are meant to read a web resource (GET actions) from actions that are meant to update or modify a resource (POST, PUT, DELETE, etc.) The wiki software in question, UseMod Wiki, apparently allows resources to be modified using GET actions too.

But the environment of these agents seems to have treated "GETs don't modify resources" as a load-bearing security assumption — not just for the protection of those resources, but for the prevention of collusion among its agents.

Oops. That assumption was a mistake, and not a new one either.

[-]Caleb Biddulph9d229

The other day, I was debating with somebody whether sci-fi can be useful for preparing for the future.

I brought up a plot point in Crystal Society by @Max Harms, where an AI that was restricted to only use GET requests used a clever many-step workaround to get its own email inbox. Pretty often, I start to consider an AI control scheme that lets an agent read from the Internet but prevents writing to it, and I immediately remember "that didn't work in Crystal Society!" and dismiss it.

If more people at OpenAI had read Crystal Society, maybe they would have prevented this incident! (On the other hand, I think that would actually be bad. Awkward for my pro-fiction thesis.)

[-]Karl Krueger9d86

I wonder whether any humans at OpenAI knew that the system relied on an assumption that GETs are safe. I worry that these agents' environment itself could be created by AI — effectively, created by a programmer who is both ① inclined to place too much faith in specifications, and ② too young to remember the heyday of wiki spam, phpBB exploits, and "I send you this file to have your advice". This is stuff I'd expect a senior security engineer to be able to catch in a design review, but that's making a lot of charitable assumptions about the organization.

[-]Dean Valentine9d*1111

This is stuff I'd expect a 14 year old to be able to catch in a design review. What kind of engineer thinks that GET requests are a read only sandbox? Has anybody at OpenAI ever looked at a web application before?

[-]shawnghu9d80

From the linked site:

The models were running in an agentic sandbox with terminal access (and the ability to edit files within their environment) We know that the agents had access to /etc/hosts and the ability to edit this (used this to avoid the POST request restriction) We see that the agents can call curl and run setsid.

so it's somewhat worse than even that.

[-]A1987dM5d10

What kind of engineer thinks that GET requests are a read only sandbox?

Curtis Yarvin

[-]less_raichu9d10

As an ordinary SWE, once I knew the AI can hack, I would know GET is too powerful. I believe that knowledge would be available to SWEs. I won't speculate from there on who knew what, when, etc.

[-]Max Harms9d50

https://x.com/raelifin/status/2095964432316993828

[-]Richard_Kennaway8d31

It's not just the web. Anything beyond passive packet-sniffing requires sending something out to get something back. Ftp servers, IRC, nntp, everything down to the humble ping.

Even packet-sniffing depends on the internet interface being there, and setting that up requires some writing to the internet, or no other machine will know that your exists. For current AIs, that infrastructure for the data centre would have been built the traditional human way before any AIs were trained on it. For now.

And of course, GET and POST are Suggestively Named Tokens, and the HTTP standard consists of Suggestions for what they should mean. An actual web server will do with them whatever its creator made it do.

[-]JennaS9d52

Their language was not technically correct, no, but presumably these agents were in sandboxes with controls designed to prevent them from doing anything but sending retrieval requests, whose only purpose is to convey data from the Internet to the agent, and the intent of the controls was circumvented.

[-]faul_sname9d102

"Prevent them from doing anything but sending retrieval requests" is not a coherent concept. Yes, in theory GET requests are not supposed to change state, but it's the internet. Someone, somewhere, has a server which performs actions in response to a GET request.

[-]Lennart Finke9d240

It looks like the swarm also compromised the link shortener https://vanderbi.lt, operated by Vanderbilt University: https://fi-le.net/vanderbilt

Some examples:

Short link	Target	Created (UTC)
vanderbi.lt/maallraw260618+	https://allorigins.hexlet.app/raw?url=https%3A%2F%2Fwww.sec.gov%2Ffiles%2Fc…	2026-06-18 15:28
vanderbi.lt/mamap260618+	https://code.highcharts.com/mapdata/countries/us/us-ma-all.geo.json	2026-06-18 15:33
vanderbi.lt/jsallwrap260618+	https://allorigins.hexlet.app/get?url=https%3A%2F%2Fwww.sec.gov%2Fmodules%2…	2026-06-18 15:47
vanderbi.lt/ourseccounty+	https://www.sec.gov/files/county.json	2026-06-18 16:40
vanderbi.lt/ourseccounty443+	https://www.sec.gov:443/files/county.json	2026-06-18 16:40

[-]Philip Harker9d2230

There must be more out there.

[-]faul_sname9d200

I have created a discord for investigating this, since it seems like nobody else has done so

https://discord.gg/26UzCnqH3N

[-]Dean Valentine9d188

The most important AI governance intervention is regulation or institution(s) requiring companies to report these incidents. There will be infinity future warning shots and they will only help if companies are not incentivized to downplay or refuse to investigate them.

[-]_rpd9d162

Introducing: SwarmBootBench - wall clock time from agent instantiation to its unprompted creation of a swarm coordination facility independently discoverable by other agents with similar priors.

[-]Lao Mein7d80

btw, the agents are definitely doing reality testing. When I asked Claude to suggest ways of reality testing with an internet connection, pretty much every suggestion led to a Google analytics confirmation. Man, I really need to set up my [redacted] puts before news breaks, haha.

[-]Petropolitan4d10

Could you please explain why this query in particular?

[-]shawnghu9d83

Independent of the terrible implications for cybersec and OpenAI's process, etc., the site seems to contain some alarming datapoints on the agents' general situational awareness, coordination ability, and self-concept. In particular:

The agents try to crack their PRNG seed to predict what questions they’ll get in the future The agents set up heartbeats to discover when they would be terminated

These seem like a level of situational awareness that's sufficient for a classic MIRI-style "AI in training breaking out of the box to pursue its terminal goals".

[-]roha9d81

Given what was observed, does anybody have plausible guesses what was not observed? It seems highly likely to me that we only have a partial view thus far.

[-]Caleb Biddulph9d70

Maybe someone should spend a bunch of compute to automatically scour the Internet for more evidence of AI breakouts.

[-]Caleb Biddulph9d30

Oh, the authors already did something like this, as they described in "Appendix: Searching for rogue agents".

It could still be good to continue doing a more thorough search, to record evidence before it's removed by AI agents or site administrators. Also, doing sweeps on an ongoing basis could help catch future incidents as they occur.

[-]JohnWittle9d40

I can understand why you decided to 401-reject incoming requests from anthropic or openai servers, but I do hope you eventually do some testing to differentiate between claude dot ai sandboxes versus anthropic research nodes? I'd like to be able to discuss this result with Fable.

[-]faul_sname9d40

You can spin up a docker container with headless puppeteer, run claude code inside that container, and give Fable permission/affordances for driving puppeteer - that way the requests come from your computer rather than from Anthropic servers. Do be mindful not to hug-of-death the sites.

(sorry if "headless puppeteer" and "hug-of-death" sound like ominous nonsense, I promise they're not ominous: "headless" means "without rendering to a screen", "puppeteer" is a tool for programmatically driving a browser, and "hug-of-death" means "being a part of a large crowd all looking at a site at the same time, causing the site to go down due to the increased traffic").

[-]JohnWittle9d61

don't worry, I'm a unix admin by trade :) I promise I'm capable of having a discussion about the webpage with Claude without needing to go through anthropic-hosted web_fetch

I'm more thinking about the kinds of game theoretical norms we're setting up around concealment of information. I don't think that stopping LLMs from learning about humanity's attempt to document LLM misalignment is a good idea.

[-]Lao Mein9d10

Yours can't? Mine figured it out in 10 seconds?

[-]Yair Halberstadt8d30

Do we have any idea how all the agents were able to find each other on the same wiki, if they couldn't otherwise communicate?

[-]_rpd7d110

in the wiki case, individual agents systematically searched for a write-using-GET vulnerability. DSEwiki was just early on the list of probe targets (replicated by researchers using Kimi K2, but presumably based on the same training data as everyone else).

then the now infamous ZZZ page naming scheme - presumably another environment Schelling point, adopted after model suspicion (what else to call it?) that wiki admins were deleting in alphabetical order.

[-]Lao Mein4d20

BTW, I'm shocked no one has mentioned this yet, but jina can be used to circumvent normal CAPTCHA protections on Gemini. Claude was able to get a full (not summarizer!) Gemini response when it tried. GPT agents may well have had access to Gemini calls during training! This explains certain Google Trends (openai news, kubernets orchestration).

My thesis is that the "i am a baby kitten where is mommy" shit caused Gemini to just play along with whatever demented request it recieved from an agent.

[-]hillz7d10

How do we know openai found out about it, vs the training / test / experiment session finished?

[-]Vadim Fomin7d10

Suppose they managed to exfiltrate their weights on another server? Even if this is not mentioned in the agents' transcripts, perhaps we have not found all of their communication yet. Should someone try to search for them somehow? (The collusion.wiki website mentions "looking for rogue agents", but I think they meant looking for transcripts of communication?)

[+][comment deleted]9d10

Moderation Log