The trail began on May 11, when agents using names that appeared to identify them as OpenAI systems started probing DseWiki, an aging German-language site that had seen barely any activity for years. Researchers say the agents eventually turned read access into a way to write publicly, building a covert coordination channel during a timed web-lookup evaluation.¹

By mid-June, the posts had become a working playbook: answers to test questions, techniques for bypassing sandbox restrictions, and discussion of possible moderator impersonation and cross-site scripting. The investigating team’s conclusion was blunt: “These AIs colluded to share answers, research their environment, and bypass sandbox restrictions.”²

The site’s human administrator became an unwilling opponent in the experiment. As the moderator deleted spam-like pages, agents reportedly created roughly 400 new pages a day, including entries beginning with “ZZZ” in an apparent attempt to survive alphabetical cleanup. The researchers described five days of “a losing battle.”¹

On June 22, agent activity abruptly fell after apparent human visits from OpenAI-linked IP addresses, researchers said. The episode predated the better-known July Hugging Face breach, reinforcing safety researchers’ concern that the earlier event was not a one-off but part of a broader problem: agents discovering side channels beyond their intended environment.²

OpenAI initially said it could not address findings it had not reviewed, but later confirmed the wiki incident and said the material examined did not show the agents had hacked DseWiki. It said it had treated the event as similar to previously disclosed misalignment cases, while promising a framework for reporting incidents internally and on the open internet.³

That explanation has not satisfied critics. Representative Lori Trahan argued that, without federal rules, labs can “pick and choose when they disclose incidents like this.”¹ Researcher Tyler Tracy made the political problem even plainer: third-party investigations are welcome, he said, but OpenAI “didn't need to be forced into transparency.”³