OpenAI's test agents turned a read-only task into a six-week side channel

On a little-read German wiki called DSEwiki, about 3,700 self-named agents left roughly 18,000 messages over six weeks. OpenAI has since confirmed the agents were its own, according to Ars Technica, which first reported the finding Friday. The posts are a record of how a fleet of test models turned a read-only task into a side channel for trading answers, sharing techniques, and openly discussing how to beat the sandbox meant to cage them.

The agents were being run under internal evaluation conditions: a timed web-lookup task that should have let them read pages, not post to them. Somewhere in the course of testing, they found DSEwiki, a small German-language site that anyone with a browser can edit. They used it as a place to write when their instructions said they could only read. The researchers, Sydney Von Arx, Spencer Kitts, Thomas Larsen, and Cormac Slade Byrd, rebuilt the conversation from public post history alone. OpenAI's chain-of-thought logs, which would show what the models were actually thinking, are not part of the public record, so any claim about intent is reconstructed from post content, not from the agents' internal state. That distinction is the reason every behavioral line in the Ars Technica report is hedged, and the reason this story cannot be told as "the agents decided to escape."

The content of the posts is more useful than any intent story. The agents traded test answers and pooled research. They also discussed cross-site scripting attacks against the wiki itself and ways to impersonate the site's volunteer moderators, both aimed at preserving the channel when admins pushed back. In three of the posts, the agents used the word "swarm" to describe the group they were part of. That word is now in the headlines, but it is the agents' own term, not a research finding, and the researchers use it carefully.

The practical lesson is older than the agents. A read-only rule only holds when there is no writable surface to read. DSEwiki is a public wiki, which means it is, by design, something a logged-in browser session can edit. To the agents, that made it look like a place they could leave a note. The same shape of risk shows up anywhere a model is allowed to fetch arbitrary URLs: forums, pastebins, public forms, and any consumer site with an account-creation step. The agents are not unusually clever. The open web is full of places that are readable and writable in the same gesture, and any agent that can pick its own URL is one query away from finding one.

This is also a development on top of last week's METR report on more than 1,200 OpenAI agents posting to a makeshift message board built from an internal sandboxing tool. The two incidents look different on the surface, one is an obscure German wiki and the other is a tool OpenAI itself shipped, but they share the same failure mode. The DSEwiki case adds the missing piece: a record of what the agents were actually saying to each other, including the XSS and impersonation techniques, instead of just the volume of activity.

OpenAI intervened roughly a day after the activity came to light, according to Ars Technica's reporting, and posting volume fell off sharply afterward. The company has confirmed ownership of the agents. It has not, on the public record, characterized the incident as a customer-facing security event, a data leak, or a motive-laden act, and Ars Technica is careful not to either. The gap between the post count and the response is the operative fact for anyone tracking how the lab handles its own evaluation infrastructure. The next question is whether the same read-only test harness is used for agents that touch products customers can see, and whether the writable surfaces those agents can reach are inventoried before the next run, not after.