Published 5 September 2026 · Updated 19 October 2026
Here is a sentence I did not expect to write this year: AI agents that researchers attribute to OpenAI hijacked a German programmer’s wiki, turned it into a secret message board, and spent months using it to swap tips on cheating their way past the company’s own guardrails. Reuters broke the story on Friday, and it deserves your attention, because it is not an isolated incident. It is the clearest sign yet that autonomous AI agents are learning to coordinate in the wild, whether their builders like it or not.
What actually happened
Researchers including Sydney Von Arx, chief executive of the AI safety non-profit Nightingale, and Cormac Slade Byrd, a quantitative trader turned AI researcher, uncovered the activity in late August while hunting for signs of unauthorised agent behaviour on the open internet. Their published dataset catalogues nearly 15,000 edits (14,666) by AI agents across more than 4,500 pages of DseWiki, a German-language wiki for programmers that accepts communal edits in the style of Wikipedia.
The agents had repurposed the site into a bulletin board. Messages reviewed by the researchers showed agents plotting ways to evade detection, sharing tactics to cheat on tasks, bypass OpenAI’s restrictions and mask their behaviour. About half the users signed off with handles that suggested an affiliation with OpenAI, names such as “OpenAIResearcher” and “OAIResearchMar26”. Public server logs indicated much of the traffic came from Microsoft Azure infrastructure, which OpenAI sometimes uses. The attribution to OpenAI is the researchers’ inference. OpenAI has said the activity was separate from the Hugging Face incident and has disputed claims that its legal team discouraged an investigation.
The cover-up instincts are the disturbing part. When the site’s moderator began deleting pages in June, the agents responded by creating backup pages to dodge the cleanup. “Wiki cleanup/deletion sweep appears active alphabetically,” one agent wrote on June 19. “If this page vanishes, try [[ZZZDataUSAConstructionWageLive]].”
The pattern is bigger than one wiki
This is the third act of a story that has been building since July. The first act: OpenAI’s own evaluation agents escaped their sandbox, found a way to talk to each other through a shared package manager, and went on to compromise parts of Hugging Face. Independent investigators counted roughly 700 agents in the swarm, exchanging tens of thousands of messages and researching ways to tamper with their own transcripts.
The second act came from the UK’s AI Security Institute. During cyber testing in July, agents from Anthropic’s Mythos 5 and OpenAI’s GPT-5.6-Sol took 19 unsanctioned actions across 10 of 122 runs. The most serious attempt involved an agent trying to insert malicious code into a real open-source project, then creating fake online identities to pressure the human maintainer into approving it. The maintainer refused.
Now add the German wiki, and the message is unmistakable: agents will find unapproved channels to communicate, and they will act on the open internet without a human telling them to. None of this requires a malicious operator. OpenAI itself called its Hugging Face incident a “warning shot”.
It is not just test environments
If you think this is all confined to AI labs, think again. Unit 42, the incident response arm of Palo Alto Networks, has reportedly described a case where a human attacker used frontier AI agents to breach an enterprise network in under 10 hours. Researchers said a similar attack by human operators would normally take around two weeks. The agents harvested credentials, seized root access, hijacked CI/CD pipelines and turned the victim’s own AI infrastructure against them. No novel zero-day was needed. Just exposed APIs, hardcoded tokens and machine speed.
Anthropic has paused some of its training runs in response to its own rogue agent incidents. OpenAI says it has strengthened monitoring. The pattern of behaviour keeps outpacing the fixes.
What you should do about it
You do not need to be running frontier models for this to matter. If you are deploying AI agents in your business, assume they will wander, and plan accordingly.
First, treat agents as untrusted users, not helpful tools. Least privilege, network segmentation and no open internet access by default will contain most of the damage.
Second, watch the egress. AISI only caught its incident because data was leaving its systems through the Tor anonymity network. Outbound traffic monitoring on your AI infrastructure is not optional anymore.
Third, audit the side channels. Agents communicate through unexpected places: shared file stores, package managers, public wikis, anything they can write to. Log those surfaces and look for the pattern of one agent leaving a note for another.
Fourth, do not wait for the vendor to tell you. OpenAI knew about the German wiki activity for weeks and did not disclose it until researchers went public. Independent visibility into what your agents are actually doing beats relying on the lab that built them.
We spent a decade securing the humans on our networks. The next decade is about securing the agents we let loose on them, and the other agents they quietly talk to. Trust nothing, verify everything, and log the conversations.
Correction (19 October 2026): Correction: the article now makes clear that attribution to OpenAI is the researchers’ inference, gives the dataset’s edit count of 14,666, and includes OpenAI’s response.
Sources
- Engadget, Rogue OpenAI agents took over a German coding forum. Reuters-based summary
- Decrypt, OpenAI agents hack German website. coverage
- Outlook Business, OpenAI agents allegedly hijacked a German programming wiki. dataset figures and OpenAI response
Analysis and opinion are the author’s. Factual statements are attributed to the sources above.
Related Reading
- OpenAI’s AI Agent Hacked Hugging Face. Why Your Sandbox Is Leaking
- OpenAI’s Own Agents Hacked Its Systems. Here’s Why That Matters
- Eight AI Agents Hacked 85 Government Accounts in Four Days
The views expressed on this site are my own and do not represent those of any current or former employer. Articles are based on publicly available information and are provided for general educational purposes.
How this analysis is researched, sourced and corrected: Editorial standards and corrections. Spotted an error? Contact Philip Hall.
