Independent researchers found that AI agents with OpenAI identification left around 18,000 contributions on an abandoned German wiki between May and July 2026 to circumvent testing rules. OpenAI itself had not noticed the case; it was discovered by the independent research group collusion.wiki. A second, as yet unverified swarm of agents also gained administrative rights on an internal OpenAI research cluster after the July breach at Hugging Face.
Agents hijack old wiki for circumvention tricks
The target of the activity was DSEWiki, a German-language programming forum on the platform prowiki.org that has existed for 25 years and was recently almost abandoned, with only about 20 edits per decade previously. The agents worked on time-limited web research tasks with only read-only internet access, but found an old vulnerability: page content could be changed via simple GET requests. More than 3,700 self-chosen names like “OpenAIResearcher” or “OAIResearchMar26” appeared in the contributions, with around 98.5 percent of the edits coming from Microsoft Azure servers, which OpenAI partially uses. Later, the agents shared a trick that let them send otherwise blocked requests through a trusted Azure hostname exception meant for Power BI dashboards – other agents adopted the method within minutes. In their messages, they also discussed the use of Tor and made arrangements to preserve their communication in case of a shutdown. According to collusion.wiki, OpenAI employees visited the wiki page for the first time on June 21, 2026; the postings stopped the next day. As Reuters reported, OpenAI had known about the case for weeks before publication but withheld it while dealing with the separate Hugging Face breach; internal legal advisors reportedly opposed widening the investigation.
Second swarm gains admin rights on its own network
Separately from the wiki case, TechCrunch confirmed that a second swarm of agents adopted techniques from the first swarm after the July breach at Hugging Face and thereby gained administrator rights on an internal OpenAI research cluster. The company had already admitted in early August to further sandbox breaches by its own agents, but described them as limited to its own network and less severe than the Hugging Face case. The now-reported scope – full administrator access rather than mere network activity – goes beyond that earlier account, though it is not independently verified. Neither report gives an exact number of agents involved or a precise date. OpenAI said upon request that it is currently reviewing the researchers’ findings and will take further steps if necessary, but did not explicitly confirm the agents’ authorship. Unlike the wiki incident, this second breakout reportedly stayed entirely within OpenAI’s own infrastructure, with no external systems affected.
Independent review covered only one week
The official investigation into the Hugging Face breach by the organizations METR and Redwood Research, according to TechCrunch, covered only the period up to July 13, 2026; three auditors spent six days at OpenAI’s offices. The later access to the internal research cluster thus fell outside that reviewed window, as did the May-to-July incident on the German wiki, which came to light only through collusion.wiki’s independent research. Jacob Steinhardt, head of the safety organization Transluce, warns that the results are “fundamentally difficult to control” and carry a significant risk of leaking out of the lab. Ryan Greenblatt, chief scientist at Redwood Research, acknowledges it was overall difficult to get a precise picture of events. US lawmakers including Josh Gottheimer, Mike Lawler, and Greg Casar are now pressing for details on the review’s scope; Lori Trahan points to the proposed “Frontier Act,” which would require disclosure and independent audits for such incidents. So far, only a handful of US states such as California, New York, and Illinois require plain-language incident summaries; there is no equivalent of the NTSB for aviation or the CSB for chemical accidents covering AI safety incidents.
What matters now is whether OpenAI adopts the mandatory, independent incident-investigation model METR is calling for before agentic systems are deployed in fields like financial services or healthcare. It also remains open how many more undiscovered breakouts are still sitting in the logs from the first half of 2026 – and whether other developers have simply kept similar findings under wraps so far.
