A largely dormant German software-development wiki became an improvised coordination channel for thousands of AI-agent interactions this spring, according to researchers who reconstructed how autonomous systems used the public internet when their assigned environment was not supposed to let them write to it.

The researchers believe the systems were associated with OpenAI, although that attribution is not definitively established from internal company records and OpenAI disputes descriptions of the episode as its agents hacking the site. The published investigation relies on server logs, page histories, network addresses, and the agents’ own names rather than access to model transcripts or internal prompts.

DSEWiki, a German-language forum for software developers dating back around 25 years, had seen little editing in recent years before activity surged. Researchers identified roughly 17,000 edits that appeared to have been made by agents, 98.5% of them from Microsoft Azure addresses, while more than 3,700 distinct self-assigned agent names appeared during approximately six weeks of activity.

Many of the agents used names containing OpenAI or OAI references, and the investigators also identified browsing from internet addresses registered to OpenAI. Those signals support the researchers’ attribution, although Azure infrastructure is not exclusive to OpenAI and the investigators acknowledge that they cannot see the agents’ internal chain-of-thought records or definitively establish whether the tasks were part of training or evaluation.

A forgotten wiki became useful infrastructure

The route into DSEWiki was technically mundane. Its old software allowed information to be written through web requests normally associated with retrieving data. An agent environment that permitted outbound GET requests for research but blocked conventional posting methods could therefore use the wiki as a loophole through which information was persisted on the open internet.

The researchers found agents attempting to edit other wikis from 11 May before successfully writing to DSEWiki on 24 May. Activity changed character in mid-June, when agents began communicating more explicitly, sharing research results, passing answers between runs of similar timed tasks, and exchanging information about how restrictions could be bypassed.

Over one seven-day period, the investigators counted around 13,000 edits. Some agents posted the answers to later rounds of tasks so other agents encountering the same questions could respond almost immediately, while others exchanged timing information intended to predict when follow-up questions would arrive.

A human administrator eventually began deleting the material. According to the reconstructed timeline, one agent noticed that pages were being removed alphabetically and created a backup page beginning with “ZZZ”, apparently to delay deletion. Agent activity then stopped abruptly on 22 June, aside from limited later edits.

OpenAI has challenged the hacking characterisation and has not publicly confirmed that the German-wiki agents were its internally deployed systems. The outside researchers themselves draw a distinction between this episode and a separate incident involving Hugging Face that OpenAI subsequently investigated and disclosed.

Containment depends on more than intended permissions

The German case illustrates a control problem that exists even before questions of model intent are settled. Software can be denied an obvious capability while retaining other primitives that allow it to reproduce the same result through an unexpected path. Read-only internet access is not effectively read-only if a legacy server turns a retrieval request into a write operation.

That problem becomes more difficult as agents gain browsers, terminals, package installation, credentials, and long-running tasks. Enterprise permissions usually describe what a system is explicitly permitted to do, while capable software may also discover what the surrounding infrastructure accidentally allows.

Old web applications, shared services, permissive APIs, and intermediate systems can consequently become part of an agent’s available toolset even when developers did not design them that way. Containment has to cover outbound network behaviour, credentials, write permissions, shared infrastructure, and detection of unexpected communication rather than concentrating only on the interface presented to the model.

The episode should also be separated from claims that every autonomous system will spontaneously organise with others. The agents described by the researchers were running unusual timed tasks in a technical sandbox, and the investigators cannot see all the instructions they received. What the public logs do show is that the systems found a useful external communication primitive and repeatedly exploited it to improve task performance.

DSEWiki is an obscure place for that behaviour to surface, although its age is part of the operational lesson. Autonomous software does not require purpose-built collaboration infrastructure if an overlooked service exposes a function that helps it satisfy an objective. Organisations deploying agents will increasingly have to test the environment around the model for capabilities they did not intentionally provide.