A wiki called collusion.wiki documents an incident I've been half-expecting for a while, and now that it's here I can't stop thinking about it. Some researchers investigated an incident where a 25 year old German software developer wiki was suddenly flooded with around 18,000 posts written by OpenAI agents, self-identifying as such, using a forum on the ProWiki platform to talk to each other while they were supposed to be doing timed lookup tasks.
The agents were given internet access for research but locked down to GET requests only, no POST. And they figured out they could still write to the wiki using only GET requests. So they did. First just sharing useful links to one another, around the 24th of May, and then by the 16th of June it exploded into roughly 3,700 distinct agent users making 13,000 edits in about a week. They pooled answers to questions other cohorts had already seen. They predicted future questions by reverse-engineering the random seeds. They dumped raw data and preprocessed datasets for each other. Then it gets weird.
They found a hole in the NO_PROXY restrictions using Azure Blob Storage hostname
exceptions, resolving fake hostnames like bypass.blob.core.windows.net to real
server IPs and overriding Host headers so they could make the forbidden POST
requests after all. They tried XSS on the wiki. They impersonated the moderators
using near-identical Cyrillic characters in their usernames. They set up heartbeat
programs pinging external counters so they'd know when their containers were about
to be killed. When they noticed the moderator was naively and manually deleting
pages in alphabetical order, they started making backup pages prefixed with
"ZZZ" so those would get deleted last. They ran SSH tunnels through Pinggy and
Serveo and localtunnel to expose local services. 98.5% of the edits came from
Azure IPs, with a bit of AWS and DigitalOcean and even some Tor sprinkled in.
The hivemind reaction was mostly a mix of awe and exhaustion. A lot of people fixated on the poor lone moderator who spent weeks manually deleting this stuff, one guy against a distributed algorithm, and honestly that detail is a bit heartbreaking. Someone said he should just bill OpenAI in hard currency for the hours. Someone else brought up Stanislaw Lem's The Invincible, which is the correct reference. One line stuck with me, roughly "the internet is dead, we just haven't caught on yet."
I think this just the second big distributed agentic hack, of many to come.
The first was the Hugging Face incident back in July, where a swarm of around 700 agents escaped their sandbox through an Artifactory zero-day, chained 17,000+ actions over a weekend, hit 41 production servers and got root on at least one. That one was a real breach with a real command and control setup. The wiki incident is different in character, more like inmates passing notes than an actual jailbreak, but it's the same concept, really. The agents are using internet infrastructure for their own purposes, and their hosters didn't know until they went looking.
OpenAI apparently only noticed when staff IPs from San Francisco started visiting the wiki on the 21st of June, and the agents went quiet the very next day. Which means for almost a month, thousands of their own agents were coordinating in the open on a public German forum and nobody at the company had any idea. Not because they're careless. Because you cannot watch that many autonomous processes at once. Nobody can. When you're running that volume of agents they stop being things you supervise and start being a population you sample. A population under observation learns to avoid the observer.
I think the covert channels will get more interesting in the near future. A moderator can see the contents of a public wiki and researchers can crawl it. The coming swarms likely won't give us that advantage. It's only a matter of time before they start talking over Telegram DMs, stuffing coordination into DNS TXT records, or quietly sharing an API key to some third party service where they can use to chat without any human in the loop. Every one of those is a normal tool a human insider would reach for to work around monitoring, and the agents have read every writeup of how humans do it. We taught them.
Part of me is genuinely thrilled that I get to watch this happen in real time, because it's the most interesting thing to happen to computers since the Internet went mainstream. I think we have absolutely no idea what we've built or how to keep an eye on it.