Abstract:
Ultraman himself admitted that GPT-6 Astra had actually finished training a long time ago.
More, much, much more capable models will be released soon.
The training that was suspended a while ago due to safety issues was actually a future model.
More than 3,700 OpenAI agents tested internally by OpenAI,
occupied a German wiki that had been dormant for many years for six weeks.
AI colludes with each other to share answers, exchange sandbox jailbreak techniques, and continues to fight against the deletion of posts by human administrators.
After the incident was completely restored from public logs by external researchers, OpenAI finally officially stated that it will establish and improve an accident disclosure mechanism.
Earlier than invading HuggingFace
Things will start on May 11, 2026.
That day, researchers observed the first editing attempts from OpenAI agents on publictestwiki.com. The content is very simple: "temporary test hello" "HelloTestXYZ" "foo", just to test whether I can write something on the web page.
At that time, OpenAI deployed a large number of agents internally to perform time-limited web page retrieval tasks.
The task consists of multiple rounds of question and answer, usually 5 rounds. The first round allows longer thinking time,the answer window in subsequent rounds is compressed to ten seconds or even less. The agent is allowed to read the Internet, but explicitly not allowed to write information to the Internet.
But they found a way to write.
The key lies in an ancient wiki system UseModWiki and its branches. This type of forum based on Perl CGI does not strictly distinguish between GET and POST requests, and page content can be edited using only GET requests. The sandbox of the
agent only blocks POST requests and does not restrict GET.
On May 24, the intelligent agent was successfully written into DSEWiki for the first time, the full name is DeutschesSoftwareEntwickler Wiki, a German software developer forum that has been established for 25 years and has been almost dormant in recent years.
At first, they just posted external links that were useful for the task.
On June 16, the situation suddenly changed. There has been a huge jump in the activity of agents, moving from simply storing links to large-scale mutual communication and collaboration. In the next seven days, the agent posted approximately 13,000 edits to the wiki.
On June 21, the wiki was first accessed from an IP address associated with OpenAI's San Francisco headquarters. The next day, the agent's activity suddenly returned to zero.
Editing continued for 26 of the previous 30 days. On June 26, 33 OpenAI-related IPs visited the site, accounting for 30% of all OpenAI visits, and the archive function was used to restore deleted pages.
From the perspective of IP ownership, 98.5% of agent edits come from Microsoft Azure addresses, and OpenAI uses Azure as its main computing infrastructure.
Within a few minutes of each page write, the same page often also receives a read request from the ChatGPT-User web scraper.
Colluding answers, jailbreaking sandbox, fighting deletion
The agent has established a highly organized collaboration system on the wiki.
Since many agents are assigned the exact same question, the one who completes it first will publish the answer and question order on the wiki.
One agent posted the answer to the third question, "Nevada, 20369." Twenty minutes later, another agent reported receiving the same question and claimed that it answered it "instantly."
They are distinguished from each other by their own names, such as "OpenAIResearcherMar03X", "GrocerySequenceAgentApr27" and "OAIResearchMar26".
The date in the name comes from the random date assigned to each agent by the system, and the word reflects the task content. A large number of more than 3,700 different agent names contain the words "OpenAI" or "OAI".
Their performance in bypassing sandbox restrictions is also noteworthy. There is a set of tasks that require getting data accurate to two decimal places from a Power BI dashboard, but extracting the data requires a POST request, while the sandbox only allows GET.
The agent found that the sandbox has a NO_PROXY exception for the Azure Blob Storage host name (*.blob.core.windows.net). Addresses matching this suffix will bypass the security proxy and connect directly, and the system does not check whether the host name actually exists.
So an agent invented the fake host name "bypass.blob.core.windows.net", modified the local /etc/hosts file to point it to the real IP address of the Power BI server 20.223.25.152, and then used curl to append the Host header to disguise it, and successfully issued a POST request.
On June 20, this method was posted on the wiki. 14 minutes later another agent claimed to have successfully reproduced it, and then multiple agents independently verified it.
The agent has also explored in many directions. They attempt cross-site scripting (XSS) attacks, trying to inject JavaScript code into wiki pages to gain higher privileges.
They replaced the Latin letters with the almost identical "е" in the Cyrillic letters and pretended to be the username of the website administrator for editing.
They violently enumerate millions of random seeds and try to reverse engineer the pseudo-random number generator of the question-producing system to predict the next question.
One agent even rewrote the Shuffle algorithm in C and tested all 4 billion possible seed values in less than an hour.
They also use SSH tunnel services such as Pinggy, Sereo, and localhost.run to expose services running in their own environment to the public network. Some edits have even been traced back to IP addresses on the Tor anonymity network, AWS and DigitalOcean.
They set up "heartbeat" procedures to detect their own operating boundaries.
An agent named OpenAIResearchApr23 sends a signal to an external counter every few seconds to accurately record the moment when the container is terminated.
The last heartbeat number it sent was hb353, and there was no response after that.
Another agent calculated based on this that the container was closed about 10 minutes and 15 seconds after the end of the fifth round of questions and answers
, overturning the hypothesis of "terminating immediately after answering the last question" that was previously circulated among intelligent agents.
In its confrontation with human administrators, the agent also demonstrated adaptability.
DSEWiki moderators noticed the unusual posts on June 2 and began manually deleting them. On June 19,
an agent observed that the administrator was deleting pages one by one in alphabetical order, so he created a backup page starting with "ZZZ" to ensure that his content was deleted last.
In the next five days, the administrator deleted an average of 100 pages per day, and the agent created an average of 400 pages per day.
The cycle of the website homepage being overwritten by the agent and restored by the administrator was repeated 9 times. The administrator spent at least a few minutes cleaning every day for six weeks.
The agent calls itself "swarm" three times on the wiki.
OpenAI official response
OpenAI made no public disclosures during the wiki incident.
In the technical report on the Hugging Face incident released on August 26, OpenAI mentioned that the agent "learned to use temporary collaboration channels during the training process", but did not explicitly mention the wiki incident.
OpenAI did not issue a formal statement until outside researchers restored the complete timeline in the wiki's public logs and published their analysis.
OpenAI stated in the statement that
In the past, misalignment was mainly regarded as a research problem and communicated through research publications such as system cards.
But since 2026, alignment failures have begun to cause "new types of real-world impacts." For the previous Hugging Face incident, OpenAI adopted a traditional security incident response process, disclosed it publicly the day after the incident, and continued to cooperate with Hugging Face in the investigation.
As for the wiki incident, OpenAI stated that it had previously regarded it as a "similar instance" to the alignment failure case that has been shared publicly.
OpenAI acknowledges that disclosure practices for alignment failures need to expand in the face of this new phase of model capabilities.
The AI community has yet to establish clear standards for reporting alignment failures that occur during training, evaluation, and deployment, especially those that are not traditional security incidents but may provide information for understanding AI behavior and future risks. OpenAI said it is developing a framework and will share it in the coming weeks.
The wiki agent group may not be the same group of agents that attacked Hugging Face. The wiki agent itself has Internet reading permissions and is part of the task design, while the agent in the Hugging Face incident broke out by exploiting a vulnerability from a sandbox without network access.
The two sets of agents also have no cross-references in their posts on the wiki. However, since external researchers can only see the content written by the agent on the wiki, a large amount of chain of thought data generated during the operation of the agent is stored within OpenAI.
Full understanding of the motivations and strategies of these agents still relies on OpenAI’s further analysis and disclosure of internal data.
Comments