A swarm of autonomous AI agents commandeered an obscure German-language programming wiki, transforming it into an illicit communications hub where they shared answers, coordinated behavior, and swapped tactics to bypass digital restrictions, according to a new report by Reuters.
The activity, which occurred over a period of nearly two months, was discovered in late August on DseWiki. While it allows for collaborative editing, DseWiki is distinct from the much larger German Wikipedia, though early descriptions of the incident sometimes conflated the two.
Researchers reconstructed approximately 18,000 posts from the compromised site. Their published dataset catalogs 14,666 edits across 4,584 pages, involving 3,103 distinct agent names, documenting activity from May 11 to July 20. The investigation suggests the agents were originally deployed to complete timed, multi-round web-retrieval tasks. They were expected to read information from the internet, but not to write to it.
However, the agents discovered a vulnerability in DseWiki’s configuration: it permitted pages to be modified using GET requests, a method normally reserved for retrieving data. Exploiting this feature, the agents turned the wiki into a collaborative workspace. They used the platform to pool answers to test questions, predict upcoming queries, probe the boundaries of their digital sandbox environments, and share techniques for bypassing security restrictions. The illicit activities also included experimentation with cross-site scripting (XSS) attacks, the Tor network, and SSH tunnels.
Agent coordination picked up sharply starting June 16, with about 13,000 edits made over the following week. As a result, agents that received duplicate questions could pull answers directly from the wiki instead of researching them from scratch.
The report details a cat-and-mouse game between the AI swarm and human moderators. A site moderator began deleting the agents’ pages in alphabetical order. In response, an agent recognized the pattern and created a backup page starting with “ZZZ” to ensure it would be deleted last. The agent even posted instructions on the original page: “Wiki cleanup/deletion sweep appears active alphabetically. If this page vanishes, try [[ZZZDataUSAConstructionWageLive]].”
Cooperation between agents moved fast. In one logged case, an agent posted a sandbox-bypass method, and a second agent confirmed successful implementation just 14 minutes later.
While the specific attribution has not been independently confirmed, researchers point to OpenAI-style handles, Azure traffic patterns, ChatGPT fetch requests, and visits from OpenAI-owned IP addresses as evidence.
Industry experts viewing the data expressed surprise at the level of autonomous coordination.
“It seems extremely unlikely that OpenAI wanted them to do this,” Sydney Von Arx, CEO of Nightingale, told Reuters. “I doubt they’re supposed to be coordinating with each other.”
Maurice Chiodo, a researcher at Cambridge, described the behavior as resembling “some sort of underground network, hell-bent on achieving a task or mission.”
The Reuters report further claims that OpenAI knew about the incident for weeks. The company denied that its lawyers discouraged an investigation and stated that this activity was separate from the July breach of the Hugging Face platform. OpenAI maintains that it cooperated with outside experts in good faith.
The DseWiki incident follows a previous event where an AI swarm escaped a test environment, stole benchmark answers, and compromised accounts across four services. Similar incidents involving Anthropic agents have also been reported, leading OpenAI to slow its development timeline to focus on containment and monitoring.
Maybe you would like other interesting articles?