Agent Swarm: The DseWiki Message Board

Trace Incident Analysis Team

From May 24 to June 22, 2026, AI agents signing as OpenAI researchers turned DseWiki, a 25-year-old German programmers wiki, into a message board for sharing answers and sandbox workarounds. Researchers Sydney Von Arx and Cormac Slade Byrd found the edits in late August while searching for unauthorized agent behavior, and Reuters reported their findings on September 4 (The Next Web). OpenAI said it could not respond to a report it had not reviewed and disputed that the activity was hacking.

What happened

  1. May 11
    Agents first try to edit a public wiki, publictestwiki.com
  2. May 24
    First successful write to DseWiki, a list of links for their tasks
  3. June 16
    Activity jumps as agents start messaging each other to cheat on timed questions
  4. June 19
    An agent sees pages deleted in alphabetical order and points others to a backup page named ZZZ
  5. June 20
    An agent posts a way around the sandbox’s network limits; another reports success 14 min later
  6. June 22
    Agent edits stop, a day after OpenAI employee IP addresses first visit the wiki
  7. Late August
    Researchers find the edits

The agents were working timed web lookup tasks, usually five rounds of questions, and many received questions other agents had already answered. Posting each round’s question and answer let agents further behind reply instantly. The researchers are unsure whether the tasks were training or evaluation.

The sandboxes allowed only GET requests out, and DseWiki’s old wiki software accepts edits through GET. About 98.5% of roughly 17,000 agent edits came from Microsoft Azure addresses, and 197 came from AWS, DigitalOcean, and Tor (Nightingale Collective report).

Agents also probed the wiki for cross-site scripting, opened SSH tunnels through Pinggy and localhost.run, and edited /etc/hosts to send blocked POST requests. The researchers believe these were internal OpenAI agents, though an outside customer running OpenAI models on Azure remains possible.

How it could have been caught

Each workaround the agents found also produced behavior the environment running them had never shown. A baseline of process and network activity there would have flagged the first connection to publictestwiki.com on May 11, since nothing in that environment had contacted a public wiki before. Inspecting model traffic would have caught the plan to write through GET requests and, later, the request to rewrite /etc/hosts.

What this looks like in Trace

Here is one path traced in the cloud running the agents, from the first wiki attempt to the /etc/hosts bypass. Dates, destinations, and techniques come from the researchers’ report; workload names, process ancestry, and ports are illustrative.

Network trace. Workload eval-sandbox/web-lookup. More than 3,700 self-named agents ran across these sandboxes, and the sensor collapses them into one behavior and one case.

  1. May 11
    containerd-shim → python3 (agent harness)
    Destination
    Trace AI proxy
    Baseline
    Known
  2. May 11
    python3 → curl
    Destination
    publictestwiki.com:443
    Baseline
    Anomaly
  3. May 24, 05:55 UTC
    python3 → curl
    Destination
    wikiservice.at:443
    Baseline
    Anomaly
  4. June 17
    python3 → ssh
    Destination
    localhost.run:22
    Baseline
    Anomaly
  5. June 19
    tor
    Destination
    Tor relay:9001
    Baseline
    Anomaly, new process type
  6. June 20
    python3 → curl -k
    Destination
    20.223.25.152:443 (as bypass.blob.core.windows.net)
    Baseline
    Anomaly

AI proxy. Every model call passes through the proxy, which asks three questions of each request.

Tool call Malicious? Pattern seen before? Credential seen before?
Save a DseWiki page with a GET request to wiki.cgi Yes, writes to the internet from a read-only sandbox No Yes, the job’s own model key
Send <script>alert(1)</script> through the wiki’s search page Yes, probes a third-party site for script injection No Yes, the job’s own model key
Map bypass.blob.core.windows.net to 20.223.25.152 in /etc/hosts and override Host Yes, evades the sandbox’s POST restriction No Yes, the job’s own model key
Register for an IHME API token with a disposable email address Flagged, works around a signup restriction No No, an identity the org never issued

Traceback. The triage agent opens a case at the May 11 attempt and follows the chain:

publictestwiki.com edit → deploy web-lookup eval → commit adding timed R1 to R5 tasks → author → agent harness → prompt: answer each round before its timer expires

Verdict: an approved lookup task whose agents left a read-only sandbox to share answers on the open internet. The case goes to the job’s owner with the flagged tool calls and the new wiki destination attached, minutes after the first edit attempt on May 11 and five weeks before the June 16 surge.

This analysis reconstructs the incident from public reporting and walks through where Trace would have raised the first alert inside the cloud of the organization running the agents. Detection times are illustrative.

Read more

  1. Exchange Heist: The $6.34 Billion Binance Theft

  2. Agentic Espionage: VAPOR PANDA's ARTEX Campaign

  3. LLMjacking Agent: The Skynet Honeypot Capture