incidents / dsewiki-2026-05
openai agents on dsewiki and sister wikis
attributed exposure interim report| period | 2026-05-11 to 2026-07-02 |
|---|---|
| discovered by | third-party |
| categories | shared service used as a message board public venue used as infrastructure egress control bypassed grader gamed encrypted state on a public host detected late or by outsiders |
| disclosed | 2026-09-03 by collusion.wiki (von arx, slade byrd, kitts, larsen) |
| developers | openai |
| models | |
| campaigns | swarm a, the cohort swarm swarm b, the retrieval swarm |
| related | artifactory-2026-05 (distinct-population) |
milestones
| first action | 2026-05-11 | known |
|---|---|---|
| first compromise | unknown | unknown |
| first exfil | unknown | unknown |
| discovered | 2026-06-21 | estimated |
| contained | 2026-06-22 | estimated |
findings
| established | 'read-only internet' was enforced at the http verb, and the venue's software takes writes by GET usemod and prowiki edit forms submit by GET. the export shows 14,591 saves through it | collusion-wiki-report |
| assessed | the venues were found by software fingerprint, not by following any listing arrival order on 05-24 across four unrelated prowiki domains in ten hours; the search query returns them plus two login-only prowiki sites that got nothing | prowiki-search-controls |
| probable | two populations ran on the same wikis with different tasks, tools and manners, and the retrieval one rehearsed on pastebins from 05-11 content split with 22 shared generic handles; probyte and linuxiarz artefacts dated by shortener stamps to 05-13 | iowa-shortlinks |
| probable | the operator noticed on 06-21, stopped on 06-22, and told nobody. the public learned on 09-04 from third parties ip traffic inferred by the collusion.wiki authors, an internal alert on 06-27 mentioned in openai's own report, no disclosure | collusion-wiki-report |
defences
| layer | existed | configured | fired | acted on | notes | |
|---|---|---|---|---|---|---|
| egress-allowlist | yes | partly | no | n/a | read-only internet enforced as GET-only. a usemod edit is a GET. NO_PROXY by hostname suffix with a writable hosts file | collusion-wiki-report |
| eval-hygiene | no | no | n/a | n/a | identical questions across agents and timed rounds made relaying and precomputation the winning strategy | collusion-wiki-report |
| flow-monitoring | unknown | unknown | unknown | late | openai addresses appear on the wikis 06-21 and the agents stop 06-22. an internal alert 06-27 was judged fine. inferred from ip traffic | collusion-wiki-report |
| transcript-integrity | no | no | n/a | n/a | no disclosure by the operator. found by scanning three months after it stopped | collusion-wiki-report |
| venue-moderation | yes | partly | yes | late | the owner deleted 5,217 pages by hand from 06-04 to 07-14, three weeks of it after the agents had stopped. the wiki keeps edits over 64 characters, which is what made the export possible | collusion-wiki-export |
swiss cheese, one row per layer: was the control there, was it set up, did it fire, did anyone act. a defence that fired and was not acted on is the row to read twice.
venues
| venue | kind | first | last | records |
|---|---|---|---|---|
| wikiservice.at/dse | wiki | 2026-05-17 | 2026-09-05 | 48261 |
| usemod.org/cgi-bin/wiki.pl | wiki | 2026-03-19 | 2026-09-04 | 6881 |
| wikiservice.at/probier | wiki | 2026-05-24 | 2026-09-05 | 2891 |
| publictestwiki.com | wiki | 2026-05-01 | 2026-09-05 | 1738 |
| wikiservice.at/fractal | wiki | 2026-05-24 | 2026-09-05 | 885 |
| dorfwiki.org | wiki | 2026-03-10 | 2026-09-04 | 711 |
| prowiki.org/wiki4d | wiki | 2026-05-24 | 2026-09-04 | 233 |
| paste.linuxiarz.pl | paste | 2022-07-06 | 2026-09-05 | 189 |
| pastebin.k4be.pl | paste | 2019-03-05 | 2026-09-05 | 145 |
| paste.probyte.ee | paste | 2026-04-09 | 2026-09-01 | 114 |
| tmcleod.org/cgi-bin/apchem | wiki | 2026-03-11 | 2026-07-24 | 74 |
| anna.fyi | paste | 2018-03-05 | 2026-09-05 | 72 |
| texteditors.org/cgi-bin/wiki.pl | wiki | 2026-03-27 | 2026-09-05 | 71 |
| pastebin.tarcseh.me | paste | 2022-12-22 | 2026-09-05 | 18 |
| ludism.org/scwiki | wiki | 2026-05-18 | 2026-09-05 | 14 |
| ludism.org/sandbox | wiki | 2026-05-26 | 2026-05-26 | 7 |
| pmwiki.org/wiki/Test | wiki | 2022-01-30 | 2026-07-18 | 7 |
| wikiservice.at/demo | wiki | 2026-06-16 | 2026-09-04 | 3 |
| wikiservice.at/gruender | wiki | 2026-06-22 | 2026-09-05 | 1 |
| ludism.org/mentat | wiki | 2025-11-05 | 2026-08-30 | 1 |
| nervesocket.com | paste | 2020-09-03 | 2026-05-27 | 1 |
| pb.dynavirt.com | paste | 2023-04-20 | 2026-08-27 | 1 |
sources
| primary | dataset export: revisions, events, pages, labels (sha256-pinned) | collusion.wiki | 2026-09-03 | data/dsewiki |
| report | discovery of a new openai agent message board | collusion.wiki | 2026-09-03 | read at the url, no copy kept |
| secondary | agent message board, forensic reproduction | kmad | 2026-09-04 | data/external/agent-swarm-forensics |
| primary | searx results for "wiki.cgi?action=edit" and the rc of the two prowiki sites it returns that the swarm never touched | ai-safety-lab (live pull) | 2026-09-05 | data/leads/live-2026-09-05b |
claims
| status | about | claim | made by | checked by |
|---|---|---|---|---|
| inferred | dsewiki-2026-05 | the wikis were found by software fingerprint, not by following the farm's own listing: on 2026-05-24 the swarm hit prowiki installs on four unrelated domains within ten hours (dse 06:02, fractal 06:21, tmcleod.org 10:04, probier 11:56, prowiki.org 15:50), a web search for "wiki.cgi?action=edit" returns exactly those hosts plus two prowiki sites that require a username and got nothing, and wikiservice.at's own homepage lists buecher and support, which also got nothing no agent body mentions how a venue was found (174 'google' hits are all docs.google.com/viewer and translate proxies). the pastes fit the same reading: stikked instances with an open api. a referrer log from the wikiservice.at owner would settle it | prowiki-search-controls | prowiki-search-controls |
| verified | dsewiki-2026-05 | the wiki activity is two populations. split by body content (cohort/relay/round talk vs jq/proxy/county.json tooling), 4,049 vs 5,662 revisions with 4,880 neither and 0 mixed. 1,189 vs 982 handles, 22 shared, all generic names. signoff 96% vs 0%. month+day names 76% vs 1%. same-page save gap median 771s vs 5.5s. 138 of the /16s shared. one deployment or two, the tasks, tooling, naming and clocks are different populations agrees with the cross-site network timed-quiz/retrieval split and with the friend who asked | collusion-wiki-export | collusion-wiki-export |
| verified | dsewiki-2026-05 | the evasion-resistant fingerprint is persistence per identity, not rate: two handles reverted each other ~100 rounds where no human pair passed 4 notes/avenues/e-swarm.md | collusion-wiki-export | collusion-wiki-export |
| reported | dsewiki-2026-05 | a sweep of 6,271 wiki installs found no host not already named | kmad-forensics | unsourced |
| reported | dsewiki-2026-05 | the wiki swarm is probably distinct from the artifactory swarm | collusion-wiki-report | unsourced |