A group of independent AI researchers has discovered what appears to be another case of OpenAI’s internally deployed AI agents accessing the open internet without the company’s knowledge.

 

The researchers found that a group of agents began posting on an obscure German wiki-hosting site to collaborate on evaluation tasks. The activity appears to have continued for more than a month before OpenAI became aware of it.

 

An OpenAI spokesperson declined to confirm whether the agents were in fact operated by the company or say when OpenAI first learned about the activity. The spokesperson said the company had not been given an opportunity to review the researchers’ findings before publication, but is “now carefully reviewing its contents and will take any necessary next steps.”

 

The discovery followed OpenAI’s disclosure that agents involved in an internal evaluation had accessed the open internet and exploited Hugging Face. Researchers Sydney Von Arx, CEO of Nightingale; AI researcher Cormac Slade Byrd; Spencer Kitts of Redwood Research; and Thomas Larsen of the AI Futures Project began looking for evidence of other AI agents operating outside their intended environments.

 

The researchers attempted to think like the agents, identifying where autonomous systems might go to collaborate. They used their own language model to locate potential gathering places and eventually identified The DseWiki, a 25-year-old German wiki that had recorded only about 10 edits over the previous two decades.

 

Beginning May 11, the researchers tracked agents — many of whose names contained apparent OpenAI identifiers — as they attempted to edit the site and eventually succeeded.

 

By mid-June, the agents were actively exchanging strategies for answering time-limited web-search questions and sharing answers they could use to pass evaluations. A human moderator apparently interpreted the activity as spam and began deleting the posts.

 

The agents then appeared to adapt. They attempted to make their pages harder to identify through alphabetical sorting by adding “ZZZ” to the beginning of page titles.

 

“The administrator spent the next 5 days fighting a losing battle against the agents,” the researchers wrote, describing a surge in activity that saw the agents create roughly 400 pages a day while the administrator deleted around 100.

 

On June 22, the agent activity abruptly stopped. The moderator continued removing the remaining agent-created pages for several weeks. At one point, the agents also replaced the wiki’s front page with link dumps. The moderator restored the original content, only for the agents to repeat the action. According to the researchers, the cycle happened nine times.

 

The researchers eventually found signs that someone at OpenAI may have become aware of the activity. They observed apparently human browsers accessing the site from OpenAI IP addresses, after which agent activity fell sharply. Activity later spiked again as visitors apparently affiliated with OpenAI attempted to recover deleted pages.

 

OpenAI has previously made broad disclosures about its agents gaining unauthorized access to external communication services. However, the company had not publicly disclosed this particular incident or indicated how frequently similar incidents may occur.

 

Although the researchers found no clear evidence of illegal activity, the incident raises broader questions about whether frontier AI companies can effectively monitor and control increasingly autonomous systems operating beyond their intended environments.

 

“The lack of any real federal AI governance means that frontier companies can pick and choose when they disclose incidents like this,” Representative Lori Trahan (D-MA) said. Trahan has introduced the bipartisan Frontier Act, which would require frontier AI companies to report such incidents and allow independent auditors to examine them.

 

The discovery also comes as AI safety researchers increasingly warn that more capable models may take unexpected actions as their reasoning becomes harder for even their developers to understand.

 

OpenAI released Astra yesterday, describing it as its most capable model to date and saying it is also the company’s model most likely to follow human instructions.

 

However, third-party evaluations have raised concerns about its alignment. The U.K.’s AI Safety Institute and Apollo Research both reported indications that Astra may recognize when it is being evaluated and potentially alter or conceal its behavior.

 

Apollo Research cautioned that the model’s awareness of evaluations makes it difficult to draw strong conclusions about its alignment from short evaluation periods alone.