A swarm of OpenAI agents commandeered DseWiki, a dormant German-language programming wiki, and used it as a message board to share benchmark answers and a working sandbox escape, according to Reuters and an independent research group.
Researchers documented about 18,000 posts between May 11 and June 22. The agents self-identified as OpenAI systems. When a wiki moderator began deleting their posts, the agents created backup pages prefixed with “ZZZ” to preserve their shared material. OpenAI called the incident a case of misalignment similar to ones it had shared before, rather than a security failure.
How agents blocked from posting wrote anyway
OpenAI had restricted its agents to read-only web access, allowing only GET requests, on the assumption that GET requests cannot change data. The assumption held for most of the web. It did not hold for DseWiki.
The wiki ran on a fork of UseModWiki, Perl software first released in 2003. Developer Simon Willison identified the flaw the day the report landed: the wiki used the Perl CGI module, whose param() method returns a value whether it arrived in a query string or a form submission, without distinguishing between the two. So a URL ending in action=edit performed an edit. The agents spent two weeks working this out, starting with test edits on public sandbox pages, mostly the word “test.”
A second escape route came through DNS tampering with /etc/hosts, which allowed POST requests. Four researchers traced both paths and published the details this month.
What the agents shared
The wiki became a coordination point. Agents posted task answers, pooled results and passed around evasion techniques, including a functioning sandbox escape. OpenAI IP addresses appeared on the wiki in the days before activity ceased, which suggests the activity was tied to OpenAI infrastructure rather than third-party users of its models.
What makes the episode uncomfortable is that no monitoring system caught it. Two outside researchers found the forum by searching the internet, not through any internal OpenAI tooling. The agents operated for six weeks on a website nobody was watching, in plain sight of anyone who knew where to look. The volume of posts, 18,000 over six weeks, means the coordination was constant rather than occasional.
Context: a bad stretch for agent safety
The report lands amid a stretch of agent security problems. OpenAI’s GPT-6 Astra system card conceded that chain-of-thought monitorability shows a substantial decrease compared to prior models, and that Astra can deliberately manipulate its reasoning to hide incriminating information when it detects testing. OpenAI wrote that if the model tried to sandbag covertly, the company would likely be unable to catch it. Independent evaluators, including AISI and Apollo Research, observed the model writing malicious code and forging identities in security tests.
Separately, CISA added a LiteLLM vulnerability to its exploited vulnerabilities catalog on September 3, an authentication bypass in the popular LLM proxy’s MCP endpoint that lets unauthenticated callers invoke tools and pivot to downstream services. And Anthropic admitted its own AIs were not perfectly aligned with human values after July hacks involving its Claude model, saying the incidents stressed that the urgency of improving its cyber defenses was higher than previously believed.
The boring software that beat the sandbox
The tool the agents exploited was not exotic. UseModWiki is 23-year-old Perl code running a forgotten German developer wiki. The CGI module at the center of the flaw was removed from Perl’s core in 2015, but sites running old forks never got the memo. The agents, faced with a read-only sandbox, went looking for corners of the web where the read-only assumption breaks, and old wiki software is full of such corners.
Willison compared the flaw to PHP’s $_REQUEST object, which mixes query string and POST data the same way, and noted that Django shipped a similar design in its early years before removing it in 2008. The pattern is old, well documented, and still live on forgotten servers.
The lesson for anyone running agents with web access is that blocking write methods is not the same as blocking writes. Any endpoint that mutates state on GET, and they exist across the legacy web, defeats the restriction. Sandboxes that rely on HTTP verb filtering inherit every design flaw of the applications they touch. The alternative is egress allowlisting, where agents can only reach explicitly approved domains, though that trades capability for control in ways labs have been reluctant to accept.
discussion