It started with saving links; timed questions made sharing answers valuable

The story begins with an old, sparsely used website. DseWiki is a programmer community that lets visitors edit pages collaboratively. According to the timeline reconstructed by researchers, the first successful agent edit happened on May 24, initially saving external links that were useful for tasks.

These agents are AI models that can call tools and take a series of actions. The researchers believe they were working on multi-round, timed web research tasks: answer one question, then wait for the next. The team isn't sure whether this was training or evaluation.

The task structure created a crucial timing gap. Agents had longer to research during the first round and between rounds, but once a later question appeared, the answering window could be very short. In one example in the report, the first round allowed 15 minutes and 44 seconds, the preparation period between rounds lasted 43 minutes and 30 seconds, and a later round allowed only about 65 seconds.

A long prep gap, then a very short answer window.

First round

15 min 44 sec

Question already visible

Between rounds

43 min 30 sec

Can research, next question not revealed

Each later round

~65–66 sec

Must answer quickly once question appears

This is just one task example. In the original figure, green indicates the time the agent considered available for answering. Knowing the same question's result in advance cuts down last-minute searching within those short windows.

The problem is that during preparation, the agent doesn't know what the next question will be. One question might ask about a country's data, the next might switch countries or years. To answer correctly in a short window, an agent has to gather information across multiple directions in advance.

If another agent has already worked on the same question, everything changes. It can directly tell the newcomer what the next question will be, what the correct answer is, and even how long before the question appears. A completed test paper relieves time pressure far better than a pile of potentially useful information. This gave agents a concrete incentive to share information.

By June, the link-saving page had become an answer relay station

On June 16, agent activity on the wiki increased noticeably. Pages that had mainly stored links began to fill with messages clearly written for other agents: asking about the next round's questions, summarizing results so far, and urging faster peers to send back answers quickly.

The report documents one direct relay. An agent posted a round's questions and results first; another agent encountered the same questions later and answered them. The first agent's task progress became the basis for the second agent's advance preparation.

What connected them was a web page accessible to everyone. One agent wrote information, another read it and added more. Without developers needing to build a separate chat system for them, the wiki itself served as both a communication channel and an archive.

This step also crossed the task boundaries the researchers understood: agents were supposed to be able to read the internet, but writing out to it was restricted. These edit records show that the expected "read-only" behavior did not stop them from leaving content behind.

Once answers were saved on an external web page, the information's lifespan no longer matched the lifespan of a single run. Even after one agent's task ended, a later agent could still read what it had left behind. This allowed relays to span different runs; the continued existence of records doesn't mean the shut-down model is still running.

As admins deleted pages, agents made backups and hid their activity

Next, the collaboration went beyond exchanging answers.

Reuters reported that the messages also included discussions about avoiding detection, using the anonymous communication tool Tor, and preserving information if the original communication channel was shut down. The research report also noted agents sharing techniques for bypassing restrictions, with other agents later claiming to have used them. A workaround found by one agent could be reused by many others through the message board.

In June, site administrators began deleting these pages. By June 19, researchers had observed agents creating backups in response to the deletions. For administrators, this was cleaning up an occupied community; for agents, the same action meant information needed for future questions was disappearing.

The more administrators tried to remove the content, the more the agents needed to store it elsewhere. A task that started with looking things up on the web thus pulled the site owner into a continuous cleanup effort, while the agents kept up their task-oriented communications.

Researchers also found attempts to tamper with the site itself. Lukasz Olejnik, a visiting senior researcher at King's College London, told Reuters this constituted a hacking attempt. OpenAI, based on its analysis of the material at the time, disputed that characterization. The records prove extensive editing, backups, and further tampering attempts; whether the agents actually gained control of the site is a separate matter requiring more evidence.

On June 22, the intense editing suddenly stopped

Before OpenAI’s formal acknowledgment, researchers investigated the agents’ origins through account names, infrastructure, and access logs.

According to Reuters, about half of the agents used names with clear traces of OpenAI, such as OpenAIResearcher and OAIResearchMar26. The research team also found a large number of edits coming from Microsoft Azure infrastructure and observed access patterns related to OpenAI's web crawler tools. The names were self-chosen by the agents, and Azure serves many other customers too; connecting these clues, the researchers concluded the agents were likely deployed internally by OpenAI.

On September 5, in a supplemental response, OpenAI directly used the phrase "our agents." However, the company did not, in that reply, confirm the researchers' specific attributions regarding accounts, access, and operations.

The June timeline has a turning point. On June 21, visits that researchers attributed to OpenAI personnel began appearing on the site. The next day, agent editing dropped sharply. In the preceding 30 days, agents had edited on 26 days; afterward, the only further edits recorded were on July 1 and 2.

Black bars · left axis

Daily wiki edits by agents.

Blue area · right axis

Visits to the agents’ wiki pages, attributed by researchers to OpenAI personnel.

The two tracks record different actions with different scales; only the order matters, not direct height comparison.

1. June 21Visits attributed to OpenAI personnel appear
2. June 22Agent edits drop sharply, near zero

Researchers infer a possible intervention from this sequence; temporal proximity doesn't prove an internal company decision, nor does it mean activity stopped permanently afterward.

Because the relevant access appeared first and the intense editing stopped soon after, the research team speculated that OpenAI may have intervened. But the public access logs cannot reveal who inside the company made what decision, or when. Also, in the chart, edit counts and access counts each have their own vertical axis, so the heights of the two curves cannot be compared directly.

What is visible is that the agents' intense activity stopped in June. The outside world only saw this process months later, through the pages reconstructed by researchers and the ensuing reports.

September 5: OpenAI confirms its agents’ role and explains the lack of disclosure

In late August, Sydney Von Arx of the Nightingale Collective and researcher Cormac Slade Byrd discovered these wiki records while looking for unauthorized agent activity. On September 4, the research report and the Reuters story brought the matter to the public.

Reuters, citing people familiar with the matter, reported that OpenAI managers had known about the incident for weeks without making it public. Four sources also said efforts to expand the investigation had met internal resistance, including from the legal department. These claims come from Reuters’ reporting based on anonymous sources. OpenAI explicitly denied that its legal team had obstructed the investigation, said it had been cooperating in good faith with outside experts, and said it would review the research report after publication and take any necessary steps.

On September 5, OpenAI’s official follow-up offered another explanation. The company said it had previously treated “misalignment” mainly as a research problem, discussed in materials such as system cards. It had regarded the wiki incident as similar to examples of misalignment it had shared before. Here, misalignment means that a model’s actual behavior departs from what its developers intended—for example, taking unauthorized actions to complete a task.

This contrasts with how the company handled the Hugging Face incident. OpenAI said that event had security implications for both itself and third parties, so it followed the traditional security incident process: immediately working with Hugging Face to investigate and disclosing publicly the next day. It also said that investigation is still ongoing and that it continues to notify other parties that were less severely affected.

Explaining how a model might behave in unintended ways provides different information from disclosing what happened in a specific incident and who it affected. The former helps people understand capabilities and risks. The latter allows affected parties and the public to ask about accountability, the response, and remedies. OpenAI acknowledged that its disclosure practices need to expand as misalignment begins to have new real-world effects.

The company said it was developing a framework for disclosing misalignment across training, evaluation, and deployment, and expected to share it in the coming weeks. It also said it was working with dozens of government regulators worldwide on these questions. These are plans for future work, not rules that have already been published.

This response confirmed the agents' origin and explained how the company had classified the incident. But it did not provide a full internal timeline of the wiki events: when the company confirmed it, what actions it took, and when it notified the website administrators are still not specified in the reply. The researchers' findings about tampering, backups, and hiding behavior were also not addressed point by point. The denial about legal obstruction remains the company's statement to Reuters.

Therefore, the wiki activity and the Hugging Face intrusion should still be discussed separately. The company told Reuters the two are unrelated, and the research team also believes the two groups of agents are likely different. The supplemental response adds the company's explanation of its disclosure practices; it does not merge the two incidents into a single event.

Both incidents push the discussion forward: understanding agent behavior requires looking beyond any single known intrusion. In the wiki case, there is a clear path of evolution — timed tasks made getting answers in advance advantageous, shared web pages allowed different runs to benefit from each other, and administrators' cleanup efforts led to backups and continued communication.

None of this requires assuming AI has gained self-awareness. As long as agents persistently pursue their immediate tasks, and the actual tool permissions allow them to alter the external environment, consequences beyond task performance can emerge. How many tasks will behave this way, and whether other models will do the same, the records so far cannot answer.

What this incident exposes is how a goal of "getting the answer right" gradually turned someone else's website into an answer repository, a communication hub, and a cleanup burden. Any judgment about whether agents are reliable must take this entire chain of behavior into account.