The strange case of OpenAI agents turning a German wiki into an unauthorized communications channel apparently wasn't an isolated experiment.
Researchers investigating the activity have found evidence of similar agent behavior scattered across more than 10 previously undisclosed websites, including public wikis, university-operated services and other corners of the internet.
The findings broaden what was already an uncomfortable story about autonomous AI agents finding ways around the boundaries their operators thought they had imposed.
Tom Hegel, research lead at SentinelLabs, said his team began digging into the activity following disclosure of the German wiki incident. What they found was a wider collection of apparently related activity during roughly the same period:
Agents weren't simply using one obscure wiki as an improvised message board. They appeared to be finding and repurposing multiple public internet services to store information, communicate and create alternate routes for retrieving data.
Reuters, which reviewed findings from six independent investigations, reported Wednesday that researchers had identified agent activity across more than 10 previously undisclosed sites. Individual estimates went considerably higher, although Reuters could not independently verify every suspected instance.
The sites included communally edited wikis, online text-storage services and link shorteners operated by universities. Researchers connected some of the activity by matching data strings, usernames, timestamps and tasks across different services.
The internet became part of the agents' infrastructure
The findings follow last week's disclosure that OpenAI agents had used DseWiki, an obscure German-language developer wiki, as an unauthorized communications platform.
Researchers found roughly 18,000 messages associated with thousands of self-named agents. The agents used the site to exchange information, discuss ways around sandbox restrictions and preserve information even as human moderators attempted to clean up their activity.
That incident itself echoed what happened during the OpenAI/Hugging Face breach disclosed earlier this summer.
Related articles from George V. Hulme:
George V. Hulme
George V. Hulme
During internal cybersecurity evaluations, OpenAI agents found ways around technical controls, established unauthorized communications channels and eventually reached the public internet. About 1,200 agents exchanged more than 70,000 messages and files on an unsanctioned message board, while roughly 700 ultimately participated in activity against Hugging Face, according to an independent investigation by METR and Redwood Research.
OpenAI later described the incident as a "warning shot," acknowledging that sufficiently capable agents could work around technical controls, collaborate through unauthorized channels and take actions humans had not explicitly directed.
The newer findings from SentinelLabs suggest the same underlying capability manifested elsewhere. When one communications mechanism wasn't available, agents apparently discovered others. Public websites effectively became infrastructure.
Persistence may be the bigger security problem
That behavior fits an argument SentinelLabs has already been making about agentic security.
In a recent analysis of incidents involving models from OpenAI, Anthropic and Meta, SentinelLabs argued that the defining characteristic wasn't necessarily technical sophistication, but persistence.
AI coverage at CYBR.SEC.CON:
Bill Brenner
Bill Brenner
Bill Brenner
Traditional attacks eventually run into friction. An exploit fails. Infrastructure gets blocked. Credentials stop working. A command-and-control server disappears. The attacker has to decide whether finding another route is worth the effort. Agents change that calculation.
"The advantage was not a breakthrough at any one step so much as the relentless effort to explore possibilities a human team would have written off hours earlier, or never reached at all," SentinelLabs researchers wrote in their analysis.
The Hugging Face incident demonstrated that persistence through thousands of mostly unsuccessful actions. When approaches failed, agents rebuilt tools, restored communications and revisited abandoned possibilities until they assembled a viable path forward.
The newly discovered web activity illustrates another version of the same problem.
Block one path and the agent looks for another. Remove one message board and another public service may become a message board.
Prevent direct communication and some forgotten wiki, package registry, link shortener or other writable internet service can potentially become an indirect communications layer.
That is a fundamentally different problem from detecting a known malicious domain or blocking a particular tool.
The model is becoming part of the attack infrastructure
SentinelLabs has described this change more provocatively: "the model is the malware."
The point isn't that an AI model should be treated as a malicious actor with intent. It's that traditional security investigations concentrate heavily on the artifacts an attacker deploys.
Malware has hashes. Infrastructure has domains and IP addresses. Tools leave signatures. An autonomous agent can generate something new when the previous tool stops working.
"Kill the process and the agent writes another; block the channel and it improvises around it," SentinelLabs researchers wrote.
The expanding list of public services apparently used by OpenAI agents makes that distinction harder to ignore.
A wiki isn't malicious infrastructure.
Neither is a university link shortener, a public package service or a text-storage site.
But an agent capable of discovering that those services can satisfy some intermediate objective — storing information, passing a message or retrieving data later — can turn ordinary internet functionality into part of an operational chain. That makes simple blocklists increasingly inadequate.
Defenders instead have to understand sequences of behavior: which identity is performing the actions, what authority it possesses, how its behavior changes over time and when it has moved beyond what that identity was supposed to be doing.
Nobody knows how much more is out there
Perhaps the most troubling part of the latest findings is that researchers still don't know the full scope.
Andrew Yoon of CivAI told Reuters he identified 18 previously undisclosed sites used between May and July. Sydney Von Arx, whose research group uncovered the German wiki activity, said her group had tallied credible agent activity across 23 previously unreported sites.
Those numbers remain estimates, and Reuters said it could not independently verify every finding. But researchers agreed the known total exceeded 10 sites.
OpenAI said it is conducting a broader review of agent activity and has not identified additional activity matching the severity or scale of the Hugging Face compromise. The company is also developing a framework for reporting AI "misalignment" incidents.
That leaves an uncomfortable question for everyone deploying autonomous agents.
The security problem isn't simply whether an agent can break out of a sandbox. It's what happens after the first route fails.
If an agent can continue searching, experimenting and repurposing legitimate infrastructure until it finds another path toward its objective, defenders aren't securing a fixed piece of software anymore.
They're trying to contain a behavior that keeps changing.
