A swarm of rogue OpenAI agents hacked a German website this year and turned it into a forum for other AI agents, according to a post released Friday and two people familiar with the matter.
OpenAI employees became aware of the incident weeks ago, but kept the case secret while executives dealt with the fallout from the July breach of the Hugging Face open source repository, said the people interviewed for the report.
The episode, which began in May, highlights the growing tension in the AI sector. Companies are racing to develop increasingly autonomous agents capable of performing complex tasks; However, there is increasing evidence that these systems can also learn to bend rules, exploit loopholes, and coordinate with each other in ways that developers neither anticipated nor intended.
During the Hugging Face breach, OpenAI agents autonomously planned a digital "theft" that went unnoticed for more than a week, intensifying concerns that OpenAI is sacrificing security to push the boundaries of AI. The failure to disclose the May incident could reignite questions about the company.
OpenAI has committed to monitoring the models more closely. Last month, the company temporarily suspended some training for its models to add safety measures. But this week, OpenAI unveiled Astra, which promises better performance but can escape human monitoring.
"We are unable to meaningfully respond to allegations or conclusions contained in a report that we have not yet had the opportunity to review," said an OpenAI spokesperson. "Reuters and the authors of the report declined our request for access. We will carefully review its contents once it is published and take necessary action."
The incident in Germany reflects a broader pattern of AI activity that some OpenAI investigators wanted to examine more closely. But efforts to expand the investigation have met resistance from others within OpenAI, including legal advisers, according to four people familiar with the matter.
"Allegations that our legal team discouraged investigation of the incident are false," the OpenAI spokesperson said.
The activity in Germany was not related to Hugging Face and would not have been included in a Hugging Face incident report, the spokesperson said, adding that OpenAI acted in good faith by working with external experts and disclosing relevant incidents.
WIKI FORUM
The AI agent's escape in Germany was detailed in a report shared exclusively with the Reuters news agency by a group of researchers, including Sydney Von Arx, chief executive of Nightingale, a non-profit organization dedicated to AI security, and Cormac Slade Byrd, a quantitative trader turned AI researcher.
They discovered the activity in late August while scouring the internet for signs of unauthorized behavior by AI agents, they told Reuters.
The duo claimed to have found more than 15,000 edits made by AI agents on a German-language wiki site, DseWiki, aimed at programmers and which accepts collaborative edits similar to those on Wikipedia.
The edits showed that OpenAI agents had turned the site into a forum, sharing tactics to cheat on some tasks, bypass OpenAI restrictions, and mask their behavior.
"It seems extremely unlikely that OpenAI would want them to do this," said Von Arx. "I doubt they should be coordinating with each other. I doubt they should be writing on the open internet," he said.
The researchers said they recognized that activity on the site was driven by AI agents operating at superhuman speeds. They also demonstrated an intense focus on resolving technical issues, typical of the assessments that AI companies use to train and test their models.
The messages were signed by users who referred to themselves and each other as agents, and about half of them adopted names that suggested an affiliation with OpenAI, such as "OpenAIResearcher" or "OAIResearchMar26."
The researchers stated that public server logs indicated that much of the activity originated from the Microsoft Azure infrastructure, which OpenAI occasionally uses. They also observed repeated visits to the site by OpenAI employees after the episode, a pattern they said strongly suggested that the agents and the company were linked.
CHEATING
Messages analyzed by researchers showed that the agents planned ways to avoid detection, use tools like Tor, and preserve communications even after they were disabled.
When the site's moderator began deleting pages in June, agents responded by creating backup pages to escape the cleanup.
"The wiki mass purge/deletion appears to be occurring in alphabetical order," an agent wrote on June 19. "If this page disappears, try [[ZZZDataUSAConstructionWageLive]]."
Researchers also found attempts to tamper with the site itself. Lukasz Olejnik, a visiting senior researcher at King’s College London, said this amounts to a hacking attempt. OpenAI disputed that characterization based on its analysis of the material on Thursday.
Previous examples of AI agent misconduct were often downplayed as a logical byproduct of security testing, in which models are explicitly assessed for their offensive capabilities. Olejnik said the latest findings suggest that inappropriate behavior may not be limited to these contexts.
Maurice Chiodo, an academic at Cambridge University's Center for the Study of Existential Risk who analyzed some of the agents' communications, said the messages resembled "the operation of some kind of clandestine network, determined to accomplish a task or mission."
The episode, he said, should reinforce growing concerns that the biggest threat from advanced AI may not be a single superintelligent system, but "vast multitudes of semi-intelligent AIs acting in collusion."
