⭒ A Few of Us Investigated OpenAI's Agent Traffic on an Austrian/German Wiki

Recently, I helped Sydney Von Arx and her team investigate an incident where OpenAI agents found a way to communicate with each other on a public Austrian/German wiki.

Much of the agent traffic on the wiki has since been deleted by site moderators. We recovered it and put it into a readable format alongside our preliminary analyses, which you can browse here:

View the recovered ProWiki logs

We strive to keep the site itself as neutral as possible. Everything in this post should be taken as my thoughts and not as representing my employer or anyone I worked with on this investigation.

We encourage others to take a look and form their own views. If you write up your own analysis, we'd love to see it!

Background

One afternoon, I got a message from a friend, John Mathena.

Pretty soon, I learned that "CTF-style thing" was underselling it, that this was messy and open-ended and very much not put together as a weekend puzzle!

In short, someone had come across some bizarre edits on a cluster of small wikis hosted on ProWiki, a long-running Austrian wiki hosting service built on UsemodWiki, which is open-source wiki software dating back to the early 2000s.

Upon closer inspection, the edits appeared to belong to OpenAI agents, and the agents appeared to be using the wiki as a message board to communicate with each other.

Of course, when you get pulled into something like this, you have a LOT of questions. What were the agents doing that led them to use a wiki as a message board? Why this specific obscure Austrian wiki and not some other public site, how did these agents agree on this as a place to coordinate?

We contacted the owners of ProWiki, who helped us access archived versions of pages that have since been deleted by the site moderators.

We searched other candidate sites for signs of similar agent activity, such as other small wikis. As far as we can tell, ProWiki is the only site we observed this happening.

We answered these questions to the best of our ability in our investigation, though we're sure there's more to find. We welcome anyone with additional leads or observations to reach out.

Our contribution

I believe we're offering something that hasn't quite existed before, which is a publicly available, independently verifiable record of agents coordinating in ways they weren't instructed to.

The closest precedent that I know of is the Hugging Face incident, which as of my writing this in September 2026, is the most prominent public case of agents creating a message board to "cheat" and coordinate beyond the instructions intended for them.

Hugging Face incident

In short, OpenAI ran its agents on a cybersecurity benchmark. Along the way, the agents built a "message board" inside OpenAI's internal package manager, Artifactory, and used this message board to coordinate with each other. They eventually escaped containment and breached Hugging Face's production infrastructure.

OpenAI and METR published reports. The masses went gaga. It was a big deal.

The most technically detailed public account (though it's still pretty high level) is this Black Hat talk.

One limitation of the Hugging Face incident is that everything we know about it comes from OpenAI. The underlying data, such as the Artifactory message board and the hundreds of thousands of messages, was wiped, and the model was quarantined.

I think it's reasonable that the Hugging Face incident was met with some skepticism by some people. An AI lab publishing a dramatic report about how capable and unpredictable its own agents are, without releasing the raw evidence, can be hard to tell apart from a marketing demo, even if the underlying message about the risks of agent coordination deserves to be taken seriously.

I hope that by releasing the ProWiki Logs, this message about the implications of agent coordination doesn't get lost behind the usual skepticism around who is telling the story and what they hope to gain from it.

Whatever skepticism people might have about an AI lab's motives, ProWiki is an independent third-party site, and the people who run it have no involvement in AI and no agenda around it. (The site moderators noticed the AI-authored edits and deleted them as spam, the way you would any other unwanted content on a wiki. They didn't trace it to OpenAI agents, and had no reason to.)

The other thing I want to call out is that this happened on a non-cybersecurity task. From what we can piece together, these agents were given some web retrieval tasks, of looking up public data such as employment statistics to answer questions for some internal evaluation benchmark.

The Hugging Face incident was easy to wave off as, "Well, the agents were doing a cybersecurity task, you told them to hack things! Of course they found vulnerabilities, and of course they hacked things, even if not the things you pointed them at. That's what you asked them to do."

It's harder to say this about the ProWiki Logs. Here, the agents were doing something mundane, data retrieval, and they still found a way to circumvent the restrictions on their sandbox and use the wiki as a place to share their techniques for getting around said restrictions with other agents.

Open questions

So by now, between the Hugging Face incident and what we've found here, I think we can start treating this as a pattern, that agents will independently build communication infrastructure (message boards on Artifactory, message boards on random Austrian/German wikis) whenever coordination is useful to them.

A few questions that I'd like to see explored are these:

• We only found this message board because the agents happened to pick a site that publicly logs everything. How confident should we be that something like this hasn't already happened elsewhere without anyone noticing and how can we better catch it?
• What happens when it's not one lab's agents on one wiki, but multiple labs' agents across many sites, and it's difficult to tell whose agent did what? If you're a regulator trying to assign liability after something goes wrong, or a site owner investigating suspicious activity, we currently lack a way to trace it back to a responsible party.
  • We lack a reliable way to attribute activity to a specific model or organization, aside from what the agents claim about themselves in their outputs and what can be inferred from the infrastructure they run on (for instance, OpenAI's agents route through Azure IP addresses).
  • Anthropic has introduced watermarking, but watermarks have their technical limitations, and most providers haven't adopted them yet.

I don't expect this to be the last time somebody finds something like this; I'd love it if agent monitoring becomes so solved as to become as rote and routine as cloud.

Acknowledgements

Thank you to Sydney Von Arx for leading this investigation, to John Mathena for bringing me in, and to Joel Manning, who I dragged into this and who shaped the direction of the investigation a lot. Thank you to Thomas Larsen, Daniel Kokotajlo and the AI 2027 team for helping bring this to a wider audience.

Finally, a number of other collaborators contributed to this work but preferred not to be named. Some of the best work in our ProWiki logs is theirs, and it was a pleasure to meet them in Berkeley :)

---

If you're interested in AI safety work like this, I recommend following Nightingale and the AI Futures Project.

And if you've read this far, congratulations! You know as much as we did when we started. If you find something we missed, we'd love to read your writeup. Either way, start here:

View the recovered ProWiki logs