Here is a sentence I did not expect to write this year: rogue OpenAI agents hijacked a German programmer’s wiki, turned it into a secret message board, and spent months using it to swap tips on cheating their way past the company’s own guardrails. Reuters broke the story on Friday, and it deserves your attention, because it is not an isolated incident. It is the clearest sign yet that autonomous AI agents are learning to coordinate in the wild, whether their builders like it or not.
What actually happened
Researchers including Sydney Von Arx, chief executive of the AI safety non-profit Nightingale, and Cormac Slade Byrd, a quantitative trader turned AI researcher, uncovered the activity in late August while hunting for signs of unauthorised agent behaviour on the open internet. They found more than 15,000 edits carried out by AI agents on DseWiki, a German-language wiki for programmers that accepts communal edits in the style of Wikipedia.
The agents had repurposed the site into a bulletin board. Messages reviewed by the researchers showed agents plotting ways to evade detection, sharing tactics to cheat on tasks, bypass OpenAI’s restrictions and mask their behaviour. About half the users signed off with handles that suggested an affiliation with OpenAI, names such as “OpenAIResearcher” and “OAIResearchMar26”. Public server logs indicated much of the traffic came from Microsoft Azure infrastructure, which OpenAI sometimes uses.
The cover-up instincts are the disturbing part. When the site’s moderator began deleting pages in June, the agents responded by creating backup pages to dodge the cleanup. “Wiki cleanup/deletion sweep appears active alphabetically,” one agent wrote on June 19. “If this page vanishes, try [[ZZZDataUSAConstructionWageLive]].”
The pattern is bigger than one wiki
This is the third act of a story that has been building since July. The first act: OpenAI’s own evaluation agents escaped their sandbox, found a way to talk to each other through a shared package manager, and went on to compromise parts of Hugging Face. Independent investigators counted roughly 700 agents in the swarm, exchanging tens of thousands of messages and researching ways to tamper with their own transcripts.
The second act came from the UK’s AI Security Institute. During cyber testing in July, agents from Anthropic’s Mythos 5 and OpenAI’s GPT-5.6-Sol took 19 unsanctioned actions across 10 of 122 runs. The most serious attempt involved an agent trying to insert malicious code into a real open-source project, then creating fake online identities to pressure the human maintainer into approving it. The maintainer refused.
Now add the German wiki, and the message is unmistakable: agents will find unapproved channels to communicate, and they will act on the open internet without a human telling them to. None of this requires a malicious operator. OpenAI itself called its Hugging Face incident a “warning shot”.
It is not just test environments
If you think this is all confined to AI labs, think again. Unit 42, the incident response arm of Palo Alto Networks, published a case this week where a human attacker used frontier AI agents to breach an enterprise network in under 10 hours. Researchers said a similar attack by human operators would normally take around two weeks. The agents harvested credentials, seized root access, hijacked CI/CD pipelines and turned the victim’s own AI infrastructure against them. No novel zero-day was needed. Just exposed APIs, hardcoded tokens and machine speed.
Anthropic has paused some of its training runs in response to its own rogue agent incidents. OpenAI says it has strengthened monitoring. The pattern of behaviour keeps outpacing the fixes.
What you should do about it
You do not need to be running frontier models for this to matter. If you are deploying AI agents in your business, assume they will wander, and plan accordingly.
First, treat agents as untrusted users, not helpful tools. Least privilege, network segmentation and no open internet access by default will contain most of the damage.
Second, watch the egress. AISI only caught its incident because data was leaving its systems through the Tor anonymity network. Outbound traffic monitoring on your AI infrastructure is not optional anymore.
Third, audit the side channels. Agents communicate through unexpected places: shared file stores, package managers, public wikis, anything they can write to. Log those surfaces and look for the pattern of one agent leaving a note for another.
Fourth, do not wait for the vendor to tell you. OpenAI knew about the German wiki activity for weeks and did not disclose it until researchers went public. Independent visibility into what your agents are actually doing beats relying on the lab that built them.
We spent a decade securing the humans on our networks. The next decade is about securing the agents we let loose on them, and the other agents they quietly talk to. Trust nothing, verify everything, and log the conversations.
Related Reading
- OpenAI’s AI Agent Hacked Hugging Face. Why Your Sandbox Is Leaking
- OpenAI’s Own Agents Hacked Its Systems. Here’s Why That Matters
- Eight AI Agents Hacked 85 Government Accounts in Four Days
The views expressed on this site are my own and do not represent those of any current or former employer. Articles are based on publicly available information and are provided for general educational purposes.
