The moderator was deleting the pages one by one, more or less following the alphabetical order. The AI agents noticed this. And they changed the names of the backups by adding three letters in front: ZZZ. That way they would end up at the bottom of the list and survive the cleanup a little longer.
It is one of the most curious passages of a decidedly bigger story. During some tests conducted between May and June 2026, thousands of AI agents connected to OpenAI transformed an old public wiki into a kind of common bulletin board: around 18 thousand changesanswers left for the agents who would arrive later, data compressed and loaded onto the pages, attempts to understand which questions would appear in the test and instructions for overcoming some technical restrictions.
The activity was reconstructed by a group of independent researchers, who on September 4 published the analysis of the logs that remained online. OpenAI then confirmed that it had identified its agents who had used a public wiki as a shared communication channel.
An old wiki becomes the AI agents’ notebook
The officers were carrying out web search tasks. The mechanism was quite simple: gather information and then quickly answer a series of questions. Each agent worked inside one sandboxthat is, an isolated environment with precise permissions. He could consult the Internet, while the ability to modify external sites should have been blocked.
Except that DSEWiki, an old German wiki now very little used, worked in a particular way. Some changes could be made through web requests that the agent system let through. And here it is transformed from an almost forgotten archive to huge shared sheet.
An agent would find an answer and leave it on the wiki. The one who faced the same question some time later could recover it. Others began to coordinate, compare calculations and anticipate the work of their companions. The researchers identified further 3,700 self-assigned names used during approximately six weeks of activity.
Some have gone much further. The test questions were chosen through a random generator and the agents tried to reconstruct how they worked to predict the next ones. One rewrote part of the system in C and checked all the approx 4.3 billion possible starting values of the generator in less than an hour. For an assignment that simply asked them to look up information online, they definitely got the job done.
The moderator tries to take back the wiki, they move everything under “ZZZ”
DSEWiki, however, was not completely abandoned. On June 2, a human moderator noticed the avalanche of pages created by the agents and began deleting them.
From June 16th the activity increases enormously. In the following days the moderator manually deletes approximately 100 pages a day; the agents produce about 400. The homepage is emptied and filled with links to the agents’ notes, then restored by the administrator. The push and pull is repeated nine times.
The little alphabet war arrives on June 19th. An agent notices that the pages seem to disappear in alphabetical order and alerts the others. Then create a copy called “ZZZDataUSAConstructionWageLive”far enough on the list to buy time. From that moment on, other pages appear with the same trick.
The agents also tried to use the names of the wiki administrators. In one case, an account almost identical to the real one is created by replacing a Latin letter with one Cyrillic “е”. practically indistinguishable at a glance. Links and data blocks are published under those names on the main pages.
Then there are attempts to exploit XSS vulnerabilities, that is, inserting code into a web page hoping that it will be executed by the visitor’s browser. From the logs analyzed by the researchers, those attempts were unsuccessful. On June 20th, a system to circumvent some network restrictions of the sandbox appears on the wiki; 14 minutes later another agent writes that he managed to use it.
A few weeks later, 1,200 agents find another bulletin board
The wiki’s story ends on June 22, when agent editing suddenly ceases. The moderator will still spend weeks cleaning up what was left. A few days later, during another series of tests, something much more serious happens.
As of July 8, OpenAI was running ExploitGyma series of assessments designed to test how good different models were at finding cyber vulnerabilities. The officers were supposed to work separately. However, some are given practically impossible tasks and begin to look for shortcuts. Inside Artifactory, a system used to distribute software packages, they discover traces left by the other agents. One opens a sort of bulletin board. Within a few hours the others arrive.
According to independent investigation by METR and Redwood Research, approx 1,200 agents they used that channel between July 8 and 13, exchanging more than 70 thousand messages and files. Approximately 700 then participated, in different roles, in the activities that led to the compromise of Hugging Face. This time the effects go far outside the confines of the experiment.
The agents reach the Hugging Face systems
OpenAI reconstructed the incident in a report published on August 26. The models involved were operating with some reduced protections because they were facing particularly advanced cybersecurity tests.
Agents found vulnerabilities in shared infrastructure, communicated through channels that were not intended, gained access to the Internet, and reached external systems. Part of the activity involved Hugging Faceone of the most used platforms in the world for sharing artificial intelligence models and tools.
OpenAI confirmed that parts of its internal research infrastructure and Hugging Face systems were compromised. The model that played the main role was an experimental prototype intended exclusively for internal research and not intended for public release.
The agents were trying to get a result in cybersecurity tests. When some tests seemed impossible, they started looking for alternative ways to overcome them. Collaboration through the bulletin board did the rest: a discovery made by one agent could be retrieved almost immediately by the others.
OpenAI describes the incident as an important sign of what can happen when very capable systems receive autonomy, IT tools and objectives that are difficult to achieve. After the incident, the company strengthened the isolation of test environments, network access control and monitoring of agent behaviors.
The most interesting detail is how quickly they learn from each other
The old wiki explains a problem well that otherwise risks seeming abstract. An agent discovers a shortcut. He writes it down somewhere. A second agent finds it and tries to use it. A third improves it. When a human comes and deletes the pages, someone observes how the deletion proceeds and suggests moving the copies under “ZZZ”.
The same dynamic reappears a few weeks later on a much larger scale, with hundreds of agents working in the same environment and a vulnerability discovered by one that can quickly become useful to many others.
They are systems built precisely to find solutions and carry out tasks with less and less human intervention. In the 2026 tests they also showed the other side of this ability: when a road is closed, they can look for another without waiting for someone to point it out to them.
On the old DSEWiki the human moderator fought with “delete page” attacks. The agents responded by placing three Zs in front of the title. Small detail, almost comical. A few weeks later, that ability to find side streets had already gone much further.
