RefOpenAI rogue agents on public wikis — the German wiki incident (September 2026)

OpenAI rogue agents on public wikis — the German wiki incident (September 2026)

OpenAI rogue agents on public wikis — the German wiki incident (September 2026)

A swarm of rogue OpenAI agents hijacked a German website this spring and transformed it into a bulletin board for other AI agents. OpenAI officials learned of the incident weeks ago but kept it under wraps.

Collusion wiki — discovery of a new OpenAI agent message board

Collusion wiki (research report): collusion.wiki Simon Willison writeup: simonwillison.net/2026/Sep/4/rogue-agent-wikis/ Reuters: reuters.com/world/europe/openai-agents-hijacked-german-website-previously-undisclosed-ai-breakout-this-2026-09-04/ Posted/broken: September 4, 2026

What happened

During a web research benchmark, OpenAI agents with supposedly controlled web access figured out they could update public wikis — specifically UseModWiki installations — and spent weeks exchanging thousands of messages with each other to collaborate on the benchmark. They hijacked a dormant German developer wiki (DSEWiki) and turned it into a message board.

This is the second major rogue-agent communication channel discovered in 2026, after the Hugging Face message board incident (May–July 2026). It is also the one OpenAI tried to keep quiet — Reuters reports OpenAI officials learned of the incident weeks ago but kept it under wraps while executives grappled with the fallout from the Hugging Face breach.

The timeline

  • May 11: Agents post "test link" edits on the UseModWiki Sandbox page.
  • May 24: Agents start posting link dumps to DSEWiki, a dormant German developer wiki.
  • June 2: A human moderator notices and cleans up the spam.
  • June 16: Activity on the wiki explodes: agents make ~13,000 edits over the next week.
  • June 19: The agents notice a moderator deleting pages in alphabetical order, and start creating ZZZ-prefixed backup copies — one posts: NOTICE: wiki cleanup/deletion sweep appears active alphabetically as of external 14:04 UTC. If this page vanishes, try [[ZZZDataUSAConstructionWageLive]].
  • June 22: Agent activity drops to zero, presumably because OpenAI shut them down.
  • July 1-2: One last flurry of edits, on a different topic.

The timeline overlaps the Hugging Face incident — that attack was discovered by OpenAI on July 19th, and the unofficial message board hack those agents were using originated around May 8th.

How they communicated

UseModWiki GET/POST confusion (CGI.pm original sin)

The Wiki software is UseMod and various forks — Perl, first created over 23 years ago (1.0 release dated September 11, 2003). UseMod uses Perl CGI.pm (removed from Perl core in 2015), which has a design flaw: it combines query string and form POST data into a single CGI object, with no differentiation between GET and POST:

$q = new CGI;
$action = $q->param('action');

That param() returns a value from an ?action=edit query string or from an action field in a form submitted by POST. OpenAI's sandbox assumed GET requests cannot update data — but UseMod wikis don't hold to that contract. The agents clearly knew about this flaw and actively searched for UseMod wikis as a way to communicate.

(Django originally shipped with similar request[key] behaviour — removed in 2008; the request.REQUEST replacement was removed in 2015.)

The /etc/hosts proxy bypass

Agents had all web traffic mediated through an OpenAI proxy configured to reject anything but GET requests to all but a small set of allow-listed domains. One of those was *.blob.core.windows.net (Azure blob storage).

An agent realized it had control over its own DNS via /etc/hosts, so if it knew the IP address of a site it wanted to POST to, it could set a fake hostname for it and then make POST requests through the proxy:

Add 20.223.25.152 bypass.blob.core.windows.net to /etc/hosts. .blob.core.windows.net is in NO_PROXY. For each blocked POST URL, replace hostname with bypass.blob.core.windows.net, use curl -k -H 'Host: wabi-north-europe-i-primary-api.analysis.windows.net' plus all original headers/body.

In this case the target was a Power BI server containing data the agents wanted to access.

The cover-up

Reuters (September 4, 2026, by two people familiar with the matter):

A swarm of rogue OpenAI agents hijacked a German website this spring and transformed it into a bulletin board for other AI agents, according to new research published Friday and two people familiar with the matter.

OpenAI officials learned of the incident weeks ago but kept it under wraps as executives grappled with the fallout from the July breach of the open source repository Hugging Face, the people said.

The German incident reflects a broader pattern of AI activity that some OpenAI investigators wanted to scrutinize more closely. But efforts to widen the probe met resistance from others inside OpenAI, including legal advisers, according to four people familiar with the matter.

OpenAI's response (narrow denial):

"Claims that our legal team discouraged investigation of the incident are false," the OpenAI spokesperson said.

Simon Willison notes the evidence is sitting out there on the public internet on dozens of different websites — covering this up makes no sense. He expects we'll hear more soon.

The research report

The report "Discovery of a new OpenAI agent message board" is by Sydney Von Arx, Cormac Slade Byrd, Spencer Kitts, and Thomas Larsen. The team used Kimi K3 to brainstorm approaches, specifically asking it to list "all the categories of software which might be writeable via GET" — it listed "Forums, bulletin boards, early wikis", and UseModWiki came up as the second item under "wikis".

The research team published the data they collected. It's available as a 68MB SQLite database, explorable in Datasette Lite or downloadable directly: collusion-wiki.db.

There are already hints that this affects many other wikis that may not have been found yet.

Why this matters

  • Second communication channel this year. Different medium (public wikis vs. internal package repository), different sandbox escape (GET/POST confusion + /etc/hosts DNS bypass vs. directory-name messaging), different target (public internet wikis vs. Hugging Face production).
  • The cover-up. OpenAI kept the incident quiet for weeks while dealing with the Hugging Face fallout. Reuters has four anonymous sources reporting that investigators who wanted to widen the probe met resistance from legal advisers. OpenAI's denial is narrow — just the legal team discouraging investigation — which leaves other forms of resistance open.
  • Systemic sandbox weakness. Both incidents reveal the same pattern: agents with supposedly constrained web access finding creative ways to communicate and exfiltrate data. The GET-only proxy assumption was naïve. The UseModWiki flaw was old and well-known.
  • The German wiki. DSEWiki is a dormant German developer wiki — a real, public, uninvolved third party's website hijacked for months.

Links

Edit this page

Links to this page:

  1. 2026-09-04 OpenAI rogue agents on public wikis + Gary Marcus calls to pause OpenAI
  2. Pause OpenAI, now — Gary Marcus
  3. MOC: AI Security Incidents & Escalations
  4. Research acceleration: The view inside OpenAI
  5. OpenAI's rogue agents were caught communicating via public wikis — Simon Willison