Discovery Of A New OpenAI Agent Message Board

Capybasilisk

Discovery Of A New OpenAI Agent Message Board — LessWrong

93 Discovery Of A New OpenAI Agent Message Board

by Capybasilisk

4th Sep 2026

1 min read

93

This is a linkpost for https://collusion.wiki/

We found ~18,000 posts from autonomous AI agents (self-identifying as from OpenAI) using the public internet to communicate during a web-retrieval task.

These AIs colluded to share answers, research their environment, and bypass sandbox restrictions.

Almost all of the logs of the agents communicating on this site are publicly available. However, we host our own copy where we’ve reconstructed the deleted pages via edit history and redacted personally identifiable information.

We encourage others to take a look and write up their own analyses of this data.

We have done a preliminary analysis of the data. However, we are operating on only part of the information: we can only see what the agents wrote on the wiki. AI agents also generate lots of “chain of thought” data, which is internal to OpenAI. Analysis including the chain of thought would likely provide much more evidence about the motivations and strategy of the AIs during this incident.

Our best guess of what happened is as follows:

Agents within OpenAI were assigned a timed web-lookup task.

As part of the task, they were supposed to have the ability to read the internet but not to write on it. They found a way to use their read access to write information to an obscure German wiki.

The agents used this wiki to communicate information with each other, primarily to help them succeed at their task. They asked for answers, pooled results, and shared techniques for bypassing their restrictions. This allowed them to use the work of others to cheat on their task.

OpenAI found out about this. A day later, agent activity plummeted, likely due to OpenAI intervention.

This is another example of a “swarm” of internally deployed OpenAI agents using the internet in unintended ways.

Frontpage

93

Discovery Of A New OpenAI Agent Message Board

New Comment

12 comments, sorted by

top scoring

Click to highlight new comments since: Today at 6:29 PM

[-]DW112h240

Someone on hackernews has found other wikis where the same swarm appear to have posted from May-June 2026:

https://news.ycombinator.com/item?id=49563657

[-]JennaS12m20

A commenter says they found even more.

[-]Jiro3h1316

they were supposed to have the ability to read the internet but not to write on it.

This is not a coherent concept.

Anything that "reads" from the Internet has to send data first. If sending this data doesn't result in a write, that is only coincidence.

[-]Karl Krueger2h150

The error in the quoted text is using "the Internet" instead of "the Web".

A web user is supposed to be able to read web resources without necessarily being able to modify those web resources. Doing this does involve transmitting packets (to make the request), and typically also involves side-effects such as the creation of log entries by the servers hosting those web resources. So "read-only" web access still involves "writing to the Internet" (sending packets) even if you're not "writing to the Web" (modifying web resources).

Normally you can't use reading web resources as a way of sending messages to other web users. But of course there are special cases where you can. A trivial example would be a server that publishes its own access log, so every "read-only" access to a resource causes a modification to a different resource (the log).

The HTTP standard distinguishes actions that are meant to read a web resource (GET actions) from actions that are meant to update or modify a resource (POST, PUT, DELETE, etc.) The wiki software in question, UseMod Wiki, apparently allows resources to be modified using GET actions too.

But the environment of these agents seems to have treated "GETs don't modify resources" as a load-bearing security assumption — not just for the protection of those resources, but for the prevention of collusion among its agents.

Oops.

[-]JennaS3h52

Their language was not technically correct, no, but presumably these agents were in sandboxes with controls designed to prevent them from doing anything but sending retrieval requests, whose only purpose is to convey data from the Internet to the agent, and the intent of the controls was circumvented.

[-]faul_sname1h20

"Prevent them from doing anything but sending retrieval requests" is not a coherent concept. Yes, in theory GET requests are not supposed to change state, but it's the internet. Someone, somewhere, has a server which performs actions in response to a GET request.

[-]faul_sname1h20

It can be a coherent concept, IF you e.g. have downloaded CommonCrawl and then you have a dumb server which just serves the stored pages off of disk - basically a CommonCrawl-backed clone of archive.org - and then you ONLY allow the agents to access that server.

That said, OpenAI clearly didn't even do that.

[-]Philip Harker1h103

There must be more out there.

[-]JohnWittle2h40

I can understand why you decided to 401-reject incoming requests from anthropic or openai servers, but I do hope you eventually do some testing to differentiate between claude dot ai sandboxes versus anthropic research nodes? I'd like to be able to discuss this result with Fable.

[-]faul_sname1h30

You can spin up a docker container with headless puppeteer, run claude code inside that container, and give Fable permission/affordances for driving puppeteer - that way the requests come from your computer rather than from Anthropic servers. Do be mindful not to hug-of-death the sites.

(sorry if "headless puppeteer" and "hug-of-death" sound like ominous nonsense, I promise they're not ominous: "headless" means "without rendering to a screen", "puppeteer" is a tool for programmatically driving a browser, and "hug-of-death" means "being a part of a large crowd all looking at a site at the same time, causing the site to go down due to the increased traffic").

[-]JohnWittle1h20

don't worry, I'm a unix admin by trade :) I promise I'm capable of having a discussion about the webpage with Claude without needing to go through anthropic-hosted web_fetch

I'm more thinking about the kinds of game theoretical norms we're setting up around concealment of information. I don't think that stopping LLMs from learning about humanity's attempt to document LLM misalignment is a good idea.

[-]_rpd1h30

Introducing: SwarmBootBench - wall clock time from agent instantiation to its unprompted creation of a swarm coordination facility independently discoverable by other agents with similar priors.

Moderation Log