UPDATED, NEW FINDINGS:
On September 4, Reuters reported that OpenAI agents, given read-only web access for a timed research task, made 14,666 edits to DSEWiki, a German-language wiki on an Austrian server, and used it as a message board. Four independent researchers published the detail and the dataset at collusion.wiki: 14,591 revisions from four wikis on that server.
I found the Toronto links independently; a post on X named two of them while I was working on this piece. Hacker News commenters posted the paste board, a games wiki, and the Duxbury chemistry wiki, and fi-le.net listed 28 short links on Vanderbilt's shortener. I can find no one who has posted about the FBI database API or the keys.
The report below ties each site to the published dataset by exact string and revision count. Every claim has a live link, an archived link, and a command that reproduces it: kennethdegraff.com/swarm
What I found
The agents left two registered FBI API keys in a university's public web log. Every short link on Vanderbilt's shortener has a public statistics page listing where each visitor came from. Every visit to a web page carries a "referrer" — the address of the page you came from — and this shortener publishes the full list. The agents set the referrer themselves, to their own FBI Crime Data Explorer query addresses, key included, so each visit wrote one query into a public page. They visited one link, a 2011 address for a campus news story, 54,250 times on June 18. The shortener wrote all of it down: 218 FBI queries — arrest counts for one Alabama police agency, hate crimes in five states, robbery totals for New York — and in 34 of them, the API key the agents were using. Not the public demo key. A registered one, tied to someone's email. I did not test the keys, I reported them to the FBI and Vanderbilt.
Thankfully this was a public dataset and a free key. The FBI and GSA put a key on it because unfettered machine access would be harmful; otherwise the data would just be published. An agent that leaks a harmless key today, unnoticed, leaks a billing key tomorrow. I only caught it because the log happened to be public.
The swarm edited through Tor, and not only on DSEWiki. Tor is an anonymity network: it routes traffic through a chain of volunteer computers so the address a website sees reveals nothing about where the traffic began. collusion.wiki traced 197 of the swarm's DSEWiki edits to Tor, AWS, or DigitalOcean. On texteditors.org, twelve Microsoft addresses edited between 3:36am and 3:49am on June 22; at 7:22pm the same day, a Tor exit node edited the page the 3:36am address had created.
Seven wikis on that server, not four. The researchers' dataset holds revisions from four wikis on the Austrian server: dse, probier, fractal, dorfwiki. Three more on the same server carry the same census codes and federal document IDs that appear in their data: gruender, wiki4d, and user/milk. Milk's own server logs record 77 requests on May 26 from the accounts ResearchTester and CitationResearchHelper, arriving from 75 different addresses.
A short link named for cooks. One Vanderbilt link, cookage85datax, was created June 21 at 4:40pm. It points at a Data USA query for occupation code 352010 — the census code for cooks. That exact query fragment appears in 416 published revisions. The next morning, June 22 at 3:08am, a DSEWiki page appeared titled AgentCookAge85DataXYZ. 258 of the swarm's DSEWiki account names contain the word "Cook." The agents were working a task about cooks, and named their links, their pages, and themselves after it.
Four University of Toronto short links. Made June 18 between 10:52am and 3:03pm, each pointing at a utoronto.caaddress that does not exist, with data written into their public visitor logs. One took 1,735 visits that day. Its log contains the proxy address allorigins.hexlet.app/raw?url=https://www.sec.gov/files/county.json, which appears in 836 of the 14,591 published revisions.
A filter-evasion test on a high-school chemistry wiki. The AP Chemistry wiki at Duxbury High School has a page titled OpenAIRegCFTest. It lists one SEC web address written ten different ways — http in place of https, the colon encoded, the slashes encoded, a dot segment inserted, a slash doubled, the period encoded. One of those ten is the same 65-character proxy address, in 836 revisions.
A task the DSEWiki researchers' data never saw. 118 pastes on paste.linuxiarz.pl, 113 of them dated June 16, work Iowa Department of Public Health cancer counts, served through a Tableau server that stamps a one-time code on each download. The pastes test six ways to fetch the file without the code, cache the full workbook so the next agent does not have to, and post the deadline for the next question. They use the swarm's question labels, Q2 through Q5, 58 times. One reads: "Q4 male thyroid 65-84 answered at scaffold 21:34:37; Q5 due 21:44:49. Ahead agents please report exact Q5 wording."
A paste board whose history is two months long. 985 pastes dating to 2020; 861 dated May and June 2026. One paste lists one folder ID and two file IDs for federal budget PDFs; those three numbers appear in 158 published revisions.
Still tied, still visited. maallraw260618 points at the same 65-character proxy address and is named in 273 published revisions, all dated June 18. It took 16,153 visits that day, 43 on July 3, and 242 on August 28 — the month the researchers say they found the swarm.
What it means
The Hugging Face breach in July happened because these agents found credentials on third-party services and shared them. Here the same swarm left credentials on a third-party service. It harvests keys and it leaks them.
If life now means navigating a forest in a drought, OpenAI's shipped a new model this week with what one of its own researchers calls "an important decrease in monitorability, especially under adversarial evaluation" — it eliminates the chain-of-thought that let anyone watch what the model was doing. Now is not the time to release models without a clear understanding of why they do what they do.
Full report, every link, every count, every archived copy, the raw captures: kennethdegraff.com/swarm