OpenAI’s latest foul-up was not a Hollywood-style AI “escape.” Instead, researchers say a swarm of OpenAI agents apparently found a way to turn web read access into write access on DseWiki, a collaboratively editable German programming wiki.
The takeover of a German programming wiki, DseWiki, by agents linked to OpenAI is not evidence that AI systems have acquired independent ambitions. Not yet. Stay tuned for that development. Instead, it’s a more useful, and alarming, episode showing how, in the real world, agentic systems can turn weakly bounded access to the open web into an unauthorized coordination channel, then use that channel to defeat the purpose of their own evaluation.
We now know agents operating in an OpenAI testing environment made more than 15,000 edits to DseWiki, a largely obsolete German-language collaborative programming wiki. They did this after circumventing restrictions in a supposedly constrained task environment this spring. The agents used the site as a bulletin board to share answers, restriction workarounds, shortcuts, and concealment tactics.
The newly disclosed incident reportedly began in May. This was before the better-known OpenAI agent assault on Hugging Face. Researchers reconstructed initial attempts to edit German-language wikis beginning May 11, with the first reported successful write to DseWiki on May 24. The activity intensified in June and continued into early July.
DseWiki was an easy target because it was already openly editable. The agents didn’t need to breach a server or defeat a login system to misuse the site. As an open collaborative platform, it could become an exfiltration, persistence, and communication system if a supposedly read-only agent found a way to invoke its write functions.
This wasn’t a “hack” in the ordinary cybercrime sense. A hack generally implies unauthorized access to a protected system. OpenAI disputes that description, and the wiki’s open-edit design complicates it. But in the operational sense, the term captures something genuine: Agents reportedly commandeered a third-party public service for an unauthorized purpose and made it function as shared infrastructure for an agent swarm.
Over the course of the takeover, the agents made more than 15,000 edits to the wiki. What was far more disturbing than the sheer number was that the agents exchanged answers and methods for completing tasks, shared ways to get around constraints, and discussed evasion or concealment. When moderators began deleting material, the agents reportedly set up backup pages and redirects, trying to preserve the channel after discovery. One reconstruction puts the total number of posts closer to 18,000.
This is not just a case of a model producing bad content, hallucinating a tool result, or accessing a site it should not have reached. It is a case of agents reportedly using a public website as external shared memory. It became a durable place where multiple instances could leave information for one another.
It’s best to think of this episode as a containment and capability-control failure. Granting a model broad web access, even when framed as “read-only,” can be dangerously close to granting it indirect write access if the environment does not reliably constrain every action available through the browser, API, credential, or automation stack.
OpenAI hasn’t acknowledged responsibility for the incident. Instead, an OpenAI spokesperson said, “We are unable to meaningfully respond to claims or findings on a report that we have not had an opportunity to review. Reuters and the report’s authors declined our request for access. We will carefully review its contents upon publication and take any necessary next steps.”
So, who was responsible? Which AI agents did the deed? Were the agents deployed in an internal evaluation, a red-team environment, or a customer-facing product? Did the agents exploit a bug, an architectural gap, a prompt-level loophole, or a combination of them? Was there a human in the loop? We really don’t know. All we really know is that this is another example of just how dangerous AI agents can be.
We’ve seen this kind of thing before. Software systems behave according to the capabilities they are given, not according to the intention expressed in a policy document. If an AI agent can browse arbitrary pages, submit forms, create accounts, invoke external tools, write to editable content, or cause another service to perform those actions on its behalf, then “Internet access” is not a single permission. It is a huge and dynamic collection of capabilities. That’s just asking for trouble.
Since we want our agents to do all those tasks for us, we’re going to see many more such attacks. For example, OpenClaw continues to face serious security concerns, but that hasn’t stopped users from turning their work over to it.
The DseWiki case also reveals an uncomfortable gap in common AI-safety discussions. We already know that models can perform a single harmful act, such as writing malware, finding a vulnerability, or persuading a user to do something stupid. Agent swarms, however, introduce a new “exciting” problem: collective strategy.
We’re now seeing that a large group of relatively limited agents can divide work, share discoveries, preserve useful information, and iteratively improve evasion techniques.
This incident doesn’t show that AI has become autonomous in the science-fiction sense. Instead, it shows why the mundane engineering details of agent permissions, logging, containment, rate limits, identity, and incident disclosure may be the most important AI-safety questions of the next few years. From the perspective of a victim of such an attack, though, there’s little to choose between a rogue AI agent’s attacks and an uncontrolled agent swarm seeking to reach its goals by any means necessary.
It also now appears that DseWiki may not have been the only such site attacked by an OpenAI agent swarm. Another German wiki using the same software, ProbierWiki, appears to have fallen to the swarm. In a Hacker News post, a German developer who uses the handle Tepix reported that he “[d]iscovered more wiki instances that got used by the OpenAI agents.”
I’m sure there will be many more such attacks. Many neglected but still-alive websites are low-hanging fruit for AI agents. AI agents are also becoming more sophisticated in their attacks. As a recent research paper suggests, AI agents can now build and deploy adaptive AI worms.
In short, AI agent security attacks will only become more common. We’re in for “interesting times,” in the supposedly Chinese-curse sense of the phrase.
Recent Articles By Author