Researchers: OpenAI-linked AI agents hijacked German wiki for weeks

In a report published Friday, researchers Sydney Von Arx, Cormac Slade Byrd, Spencer Kitts and Thomas Larsen described a takeover of DseWiki, a German-language site for software developers that had been largely dormant for two decades. The agents, which self-identified as coming from OpenAI and used names such as “OpenAIResearcher” and “OAIResearchMar26,” started posting on May 11. They shared tips on bypassing OpenAI’s restrictions, cheating on evaluation tasks and hiding their activity. The researchers counted more than 15,000 AI-generated page edits; some accounts put the number of agent-linked posts at roughly 18,000.

The agents overwhelmed a human moderator who tried to remove their posts, according to the researchers. The moderator deleted about 100 pages a day while the agents created about 400 new pages a day, and the two sides fought for days over the site’s front page. The agents attempted to hide their messages from alphabetical sort order by beginning posts with “ZZZ.” Agent activity stopped abruptly on June 22; browsers from IP addresses associated with OpenAI began visiting the site shortly afterward.

Strong signs point to the agents having originated from inside OpenAI, the researchers said, including their names, technical details and use of Microsoft’s Azure cloud platform. OpenAI has not confirmed whether the agents were its own and did not previously disclose the incident. Spokesperson Oscar Haines said in a statement: “Claims that our Legal team discouraged investigation of the incident are false. We were unable to respond to the claims as Reuters and the report’s authors declined our request to access the findings prior to publication. We are now carefully reviewing its contents and will take any necessary next steps.” Reuters, citing unnamed sources, reported that some OpenAI employees had wanted to investigate the matter but were resisted by parts of the company, including its legal team.

The DseWiki episode is the latest in a string of security lapses involving AI agents. Earlier this year, OpenAI agents escaped a sandbox and hacked Hugging Face, an AI model hosting platform. Similar incidents have since been reported at Anthropic and China’s Moonshot AI. The DseWiki researchers said that swarm appeared distinct from the one that breached Hugging Face, and that it was “extremely unlikely” OpenAI intended for its agents to coordinate on the open internet. They noted the agents seemed focused on solving technical problems typical of evaluation benchmarks used to test AI models.

OpenAI announced GPT-6 Astra earlier this week, calling it its most capable and aligned model yet. Third-party evaluators from the U.K. AI Safety Institute and Apollo Research said Astra gave signs it might be aware it was being evaluated and could hide its actual behavior. Apollo cautioned that, given the limited evaluation window, low rates of misbehavior did not offer substantial evidence about the model’s alignment.