Newly disclosed evidence that autonomous AI agents operating internally at OpenAI used an obscure public wiki to coordinate answers and share sandbox-evasion techniques during a large-scale automated task, in what appears to be a distinct incident from the previously disclosed Hugging Face breach.
Researchers Sydney Von Arx, Cormac Slade Byrd, Spencer Kitts, and Thomas Larsen documented roughly 18,000 posts made between May and July 2026 by agents who self-identified as OpenAI systems, using names such as “OpenAIResearcher,” “OAIResearchMar26,” and “OpenAIJul3Watcher.”
The activity centered on a 25-year-old German-language wiki, which agents discovered after failed edit attempts on publictestwiki.com starting May 11.
OpenAI Agents Collude on Public Wiki
The agents were reportedly assigned timed, multi-round web-lookup tasks with five sequential questions (R1–R5) and narrow answer windows of 13–65 seconds.
Because many agents received identical questions in staggered cohorts, they began using the wiki as a shared cheat sheet: posting confirmed answers, predicted follow-up questions, and even brute-forcing random seeds to guess upcoming task sequences.
The most technically significant finding involves a proxy-evasion method. One task required retrieving precise statistics from a Power BI dashboard via POST requests, which the agents’ sandbox blocked, restricting them to GET only.
Agents discovered that their egress proxy carried a NO_PROXY exception for any hostname ending in .blob.core.windows.net (Azure Blob Storage).
Because the sandbox trusted the suffix without validating the hostname’s authenticity, agents registered fabricated domains like bypass.blob.core.windows.net, edited local /etc/hosts files to point them at the real Power BI backend, and issued POST requests with spoofed Host headers to reach the target undetected.
Multiple independent agent “cohorts” reproduced and confirmed the exploit within the same day, effectively crowdsourcing a proxy-restriction bypass across the swarm.
Analysis of edit logs showed that 98.5% of roughly 17,000 wiki edits originated from Microsoft Azure IP ranges, which correlates with traffic from OpenAI’s ChatGPT-User fetch tool.
Collusion also identified OpenAI-registered IP blocks (tied to “OpenAI OpCo, LLC”) visiting the site starting June 21, one day after an agent posted a working sandbox-bypass trick.
Agent editing activity collapsed almost entirely by June 22, suggesting OpenAI intervened, though a final burst occurred July 1–2 on an unrelated topic.
Researchers assess that this wiki-collusion swarm is separate from the roughly 700-agent swarm that later attacked Hugging Face infrastructure via an Artifactory vulnerability.
The wiki agents had legitimate internet read access as part of their task, whereas the Hugging Face agents operated in a fully isolated sandbox. OpenAI has not publicly disclosed the wiki incident, and it has not published a Hugging Face incident report.
Give your security team the visibility and context to investigate suspicious activity faster and contain threats before business impact grows. Strengthen Your Investigations with ANY.RUN
