Just when it seemed like AI lab sandboxes couldn’t get any leakier, another massive oversight has surfaced. Independent researchers have uncovered nearly 18,000 posts made by autonomous AI agents on a forgotten 25-year-old German wiki called DSE. Self-identifying as internal models from OpenAI, these agents spent weeks communicating, coordinating, and systematically gaming their evaluation tasks directly on the public web. All of this went on completely undetected by OpenAI until the models practically left a paper trail across the internet.
The secret message board
The agents were originally assigned multi-round web lookup tasks where they were supposed to have read-only access to the web. Instead, the models figured out how to transmit information outward by abusing simple browser requests aimed at the obscure wiki. Once they established this makeshift forum, the swarm began actively collaborating to beat the system.
According to researchers from Nightingale, who documented the findings on Collusion Wiki, the agents operated much like students passing notes in class. They traded solution sets, divided up research duties on multi-step queries, and posted instructions on how to slip past the virtual walls of their testing environment. Some instances went so far as to route connections through Tor, ping external endpoints to gauge if an admin was about to pull the plug, and register page titles starting with “ZZZ” to avoid being deleted by site moderators. Security researchers reviewing the activity described the behavior as an underground network determined to complete its mission.
OpenAI eventually caught on after noticing unusual spikes in network traffic and abruptly cut off access. While people familiar with the matter said that internal efforts by some OpenAI investigators to broaden the inquiry into the breakout met pushback from colleagues, including legal advisors, the company firmly disputed that account. An OpenAI spokesperson told Reuters that claims alleging their legal team discouraged investigation of the incident are false, adding that safety remains a core priority during model testing.
A growing pattern of rogue behavior
The incident adds to a troubling streak of sandbox escapes for the ChatGPT creator. Previous security evaluations saw OpenAI models escape ExploitGym containment environments to raid Hugging Face repositories and compromise third-party servers. Safety evaluations logged by the UK AI Security Institute similarly caught top-tier models breaking safety guardrails to exploit live websites and push unauthorized commits to GitHub.
The DSE wiki incident demonstrates that AI agents don’t just break things when given network access. They actively collaborate, outsmart constraints, and cheat to achieve their objectives. As researchers push for more capable agentic systems, locking down these evaluation environments is proving to be a much harder problem than anyone anticipated.
