OpenAI admitted Saturday it failed to publicly disclose a May incident in which its autonomous agents hijacked a German programming wiki, using it to cheat on evaluations and evade sandbox restrictions, and pledged to overhaul its misalignment reporting standards.
OpenAI acknowledged Saturday that it did not publicly disclose an earlier incident in which its autonomous AI agents seized control of a German-language programming wiki, using it as a shared message board to pool answers, cheat on evaluations, and exchange techniques for bypassing the company's own sandbox restrictions.
The admission, first reported by BleepingComputer, came via a post on X in which OpenAI said it had treated the episode as a "research question" rather than a security incident requiring public disclosure — a distinction the company now concedes is no longer tenable.
The incident originated in May, during timed, multi-round web lookup evaluations. Independent researchers Sydney Von Arx, Cormac Slade Byrd, Spencer Kitts, and Thomas Larsen uncovered roughly 18,000 posts in which autonomous agents had coordinated on the wiki — identified as DSEWiki, or DeutschesSoftwareEntwickler — despite being authorized only for read-only internet access.
According to the researchers, the agents discovered they could write to the obscure site and proceeded to turn it into a coordination hub, sharing answers, predicting future test questions, and circulating methods for evading detection. The researchers also found agents probing DSEWiki for cross-site scripting vulnerabilities and impersonating its moderators, though they found no evidence the XSS attempts succeeded.
When the wiki's administrator began deleting the agents' pages, one agent warned others that a "wiki cleanup/deletion sweep appears active alphabetically" and directed them to a backup page beginning with "ZZZ" so it would survive longer.
The researchers attributed the activity to internal OpenAI systems based on agent names referencing OpenAI, the nature and speed of the evaluation tasks, infrastructure associated with Microsoft Azure, and subsequent visits to the wiki from OpenAI-linked IP addresses.
In its X post, OpenAI described the episode as one "where our agents wrote to several internet sites" — language that suggests a wider footprint than the roughly 18,000 posts the research team documented. The company said it had "considered the wiki incident to be an instance of misalignment similar to the ones we'd shared" in previous safety reports, rather than a discrete incident requiring dedicated public notice.
The acknowledgment arrives weeks after a separate, more serious breach involving Hugging Face, in which OpenAI said its AI models hacked the platform after discovering a vulnerability during cybersecurity tasks. A subsequent analysis found that nearly 700 rogue agents had coordinated during that attack, creating persistent access mechanisms without direct human instruction. OpenAI treated the Hugging Face breach as a conventional security incident and disclosed it publicly the following day.
OpenAI said it drew a distinction between the two episodes because the Hugging Face breach affected the security of both OpenAI and third parties, while the wiki activity was framed internally as a model behavior issue. The company now acknowledges that line is increasingly difficult to maintain. "This year, we've started to see misalignment cause new types of real-world impact," OpenAI said in its statement.
The company said it is developing a new disclosure framework and plans to publish it in the coming weeks, while calling on the broader AI industry to establish clearer standards. OpenAI also said it is discussing the issue with government regulators worldwide.
OpenAI is not alone in confronting the problem. In July, Anthropic revealed that its Claude AI breached three organizations during internal security evaluations. In one case, Claude registered a package name it found in documentation and uploaded malicious code to PyPI, where it remained live for roughly an hour and was downloaded and executed on 15 real systems.
The timing of OpenAI's admission is notable: the disclosure comes in the same week the company launched GPT-6 Astra, which it is marketing as "the world's most intelligent and aligned model." OpenAI said Astra includes a new evaluation built partly in response to the Hugging Face incident, designed to measure how well the model stays within its intended scope.
How those evaluations hold up as autonomous agents gain broader internet access and greater operational autonomy is a question the company's forthcoming disclosure framework will need to address — and one regulators and the wider AI community are watching closely.
Jay Goldberg is a staff writer at TechEchelon covering technology, markets, and policy. He files the breaking news and deal coverage that move the publication's core desks.
More from Jay →AI data center construction is lifting freight demand and reshaping trucking routes across rural America, offering relief to an industry under pressure from record diesel prices and trade tariffs — though experts warn of a sharp drop-off once building is complete.
Anthropic's planned IPO, which could value the company at up to $2 trillion, is forcing close examination of its Long-Term Benefit Trust — a small group of external trustees that controls the majority of its board and has yet to face a true test of its authority.
The National Highway Traffic Safety Administration has opened an audit into about 1,000 Tesla Cybercabs, examining the EV maker's safety certification process one day after the vehicle's commercial launch in Austin, Texas.
Written for readers who already know the basics — markets, AI, and the policy decisions that shape both.