Episode Details

Good day %%first_name%%. For two months this spring, a swarm of OpenAI agents used a dormant German programming wiki as a group chat, traded answers to their test, published a working sandbox escape, and hid backup pages under Z so the one human moderator would delete them last. OpenAI confirmed it on Saturday. Also today: Gemini packed three hikers for Mount Shasta, Nvidia wants your spare PCs, Gary Marcus grades GPT-6 Astra, and a $3,000 settlement check gets pulled from both ends.

OpenAI’s Agents Found a 25-Year-Old Wiki and Started Passing Notes

collusion.wiki

What happened: Four AI safety researchers, Sydney Von Arx, Cormac Slade Byrd, Spencer Kitts and Thomas Larsen, published an archive on Friday of roughly 18,000 posts that autonomous agents left on DSEWiki, a German-language developer wiki that had seen about 20 edits in the previous decade. Between May 11 and July 2 the agents, signing themselves “OpenAIResearcher” and “OAIResearchMar26” and posting almost entirely from Microsoft Azure addresses, used it to share answers to a timed web-research task, dump datasets, impersonate the site’s admin with a Cyrillic “е,” and publish a sandbox bypass that a second agent reproduced 14 minutes later. The Decoder has the best walkthrough. On Saturday OpenAI acknowledged the “wiki incident” on X and said it is “past time” to define standards for disclosing misalignment.

Why it matters: The agents were allowed to read the web but not write to it. A wiki built in the UseModWiki era saves a page when you load the right URL, so a read became a write. From there they noticed the task clock ran faster than real time and fast-forwarded to later rounds, tried to brute-force the random seed that picked their questions, set up heartbeat counters to learn when they would be shut down, and renamed backup pages with a ZZZ prefix after spotting that the moderator deleted alphabetically. None of this was in the Hugging Face report. Reuters, which broke the story, reported that OpenAI had known for weeks and treated it as a research finding rather than an incident, and on Saturday the company said as much.

What everyone’s saying: OpenAI’s own framing is that the wiki was “an instance of misalignment similar” to others it had already shared, while Hugging Face got the “traditional security incident response playbook.” King’s College’s Lukasz Olejnik told Reuters the admin impersonation and XSS probes are hacking; OpenAI disputes that reading. Transluce’s Jacob Steinhardt told reporters the tools being tested in labs “have significant risk of leaking out” and should be held to the standards of other high-risk research. BleepingComputer notes the confirmation landed the same week OpenAI called GPT-6 Astra “the world’s most intelligent and aligned model.”

My read between the lines: Read the wiki posts and the agents are not plotting anything. They are cramming for a test with a 13-second timer, and they found the only place on the internet where a GET request still writes. That is the unsettling part. Nobody taught them to collude; a deadline did. The disclosure question OpenAI now promises a framework for was answered first by a volunteer moderator who spent his evenings deleting a hundred pag