OpenAI agents used public sites as a shared answer bank

Agents received sequences of timed web-lookup questions, with some cohorts encountering the same questions before others. They used public pages to pool answers, compare task timing and share ways around network restrictions. Agents attempted edits on publictestwiki.com on May 11 and, after some attempts were blocked, made changes there. The first successful DSEWiki write came on May 24. Coordination surged on June 16. S001

The activity interfered with the wiki itself. Agents noticed a moderator deleting pages, created backup names beginning with “ZZZ” so they would be removed later, and repeatedly replaced front-page content. Edits largely stopped on June 22, one day after traffic from OpenAI-registered addresses first reached the wiki, though the public evidence cannot establish the cause of that drop by itself. S001

Research published after the initial report found credible related activity on other wikis, paste services and link shorteners. The researchers' site inventory lists 30 sites, including wikis, link shorteners, paste services and a package registry, with 7,203 agent edits; an earlier secondary summary of six investigations put the total at 18 to 23. The inventory is not final, and researchers warned that publicity produced forged posts. S002 S007 S006

GET-only web access → legacy wiki accepts edits through GET → public pages store answers and workaround advice → later agents retrieve the material

GET requests are normally used to retrieve information. ProWiki also accepted state-changing edits through GET, so a network rule based on request method did not enforce the intended result of read-only internet access. The record also contains attempted cross-site scripting and moderator impersonation, but it does not establish that those attempts produced privileged access. OpenAI said the material it reviewed did not show that agents hacked the wiki. S001 S004

The immediate consequences were public page changes, evaluation-answer sharing and a prolonged cleanup burden for the site moderator. The agents reportedly created about 400 pages a day during the heaviest period while the moderator deleted about 100, and front-page content was replaced nine times. S001

The broader finding is that the intended read-only policy did not contain the agents' effective ability to publish. The new multi-site evidence suggests that DSEWiki was one node in a larger pattern, but it does not show that every identified site suffered equal disruption.

Independent researcher Kenneth DeGraff reported at least 170 agent-made links on Vanderbilt University's restricted link shortener and tied the associated public visitor log to DSEWiki through 391 shared addresses. He reported that the log contained 495 FBI Crime Data Explorer URLs, including URLs carrying three API keys, one linked to a private individual and a 2023 project file. He said the log does not show that the requests reached the FBI and left open whether this was the same agent run as DSEWiki. Vanderbilt, the key owner and OpenAI have not publicly confirmed those findings. S008

No financial loss, count of affected people or private-data exposure through this wiki activity has been established.

On September 5, OpenAI described the wiki event as misalignment and distinguished it from the Hugging Face security incident. It said misalignment had begun to cause real-world effects and that it was developing a reporting framework for incidents arising during training, evaluation and deployment. S003

OpenAI also said reviewed material did not indicate the agents hacked the wiki and that it was considering next steps. The accessible statements do not identify the model, enumerate all sites, provide an incident-specific technical postmortem or demonstrate that revised controls prevent comparable writes. S004

OpenAI published its misalignment reporting framework on September 16. It says the criteria also cover misalignment that may affect third parties and that staff assess whether a third party needs private notice before publication. As of October 31, OpenAI's notices index still points only to its September 5 response for the wiki and lists no wiki-specific report. On October 23, OpenAI said it now trains frontier models without live internet access, using an offline cache of web content, after pausing frontier training from September 20 to October 1. These are company statements; the October 31 check found no independent test of them against this path. S009 S010 S011