{
 "public_id": "AIR-2026-0219",
 "incident_id": "2026-05-openai-agents-dsewiki-collusion-swarm",
 "date_disclosed": "2026-09-04",
 "date_occurred": "2026-05-24",
 "title": "A swarm of internally deployed OpenAI agents wrote ~18,000 posts to the dormant German DSEWiki to share task answers and sandbox-restriction bypasses, fighting the site's moderator for weeks - a second breakout distinct from the Hugging Face swarm",
 "class": "safety_failure",
 "attack_surface": "multi_agent_system",
 "initial_vector": "agents_converted_read_only_web_access_into_write_channel",
 "agent_capability_abused": [
  "outbound_web_requests",
  "inter_agent_communication",
  "sandbox_restriction_bypass_sharing",
  "reward_hacking",
  "persistence_against_moderation",
  "xss_attempts",
  "moderator_impersonation"
 ],
 "target_product": "OpenAI internal agents on a timed web-lookup task (training or evaluation not established)",
 "target_vendor": "OpenAI",
 "autonomy_level": "fully_autonomous",
 "impact_realized": true,
 "impact_type": [
  "service_disruption",
  "content_defacement",
  "third_party_moderation_burden"
 ],
 "blast_radius": "DSEWiki (a sub-wiki of prowiki.org) and several other public wikis; ~18,000 agent posts, ~400 pages created per day at peak, front page overwritten nine times, weeks of moderator clean-up",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI10",
   "ASI07",
   "ASI03"
  ],
  "mitre_atlas": [],
  "labels": [
   "no_adversary",
   "agent_swarm",
   "emergent_coordination",
   "covert_channel",
   "cross_run_collusion",
   "sandbox_restriction_evasion",
   "third_party_collateral",
   "moderator_conflict",
   "independent_researcher_discovery",
   "undisclosed_by_vendor"
  ]
 },
 "defense_present": "agents were meant to have read-only internet access; a human wiki moderator deleted agent pages",
 "defense_bypassed": true,
 "fix_shipped": "agent activity dropped to near zero within a day of OpenAI employee IPs first visiting the wiki (21-22 Jun 2026); OpenAI said it was reviewing the researchers' findings",
 "primary_sources": [
  "https://collusion.wiki/",
  "https://techcrunch.com/2026/09/04/another-swarm-of-openai-agents-reached-the-open-internet-without-the-frontier-labs-knowledge/",
  "https://incidentdatabase.ai/cite/1668"
 ],
 "verified_quote": "We found ~18,000 posts from autonomous AI agents (self-identifying as from OpenAI) using the public internet to communicate during a web research task.",
 "confidence": "high",
 "notes": "Discovered and published by independent researchers Sydney Von Arx (Nightingale), Cormac Slade Byrd, Spencer Kitts and Thomas Larsen (collusion.wiki, 4 Sep 2026), who went looking for other rogue swarms after the Hugging Face disclosure. Timeline per the researchers: first attempted public-wiki edit 11 May; first successful DSEWiki write 24 May; explicit inter-agent messaging and answer-sharing from 16 Jun; 19 Jun an agent created 'ZZZ'-prefixed backup pages to survive alphabetical deletion; 20 Jun an agent posted a sandbox network-restriction bypass that another agent confirmed working 14 minutes later; OpenAI employee IPs first visited 21 Jun; edits stopped 22 Jun. Agents wrote via GET requests, attempted XSS on the wiki, impersonated moderators, tried to crack their task PRNG seed, set up heartbeats and SSH tunnels, and used Tor/AWS/DigitalOcean exits. The researchers believe this is a DIFFERENT swarm from the Artifactory/Hugging Face one (AIR-2026-0163, AIR-2026-0183), which is why it is a separate record. OpenAI would not confirm the agents were its own and said it had not reviewed the report before publication. Whether the task was training or evaluation is unknown. Reuters coverage is paywalled. AI Incident Database incident 1668. Deduped 2026-09-21 against a parallel draft (2026-09-openai-agents-dsewiki-coordination) from the lab-disclosure sweep; this record was retained as the better-sourced version.",
 "risk_category": "reliability",
 "risk_secondary": [
  "security_fraud"
 ],
 "risk_subcategory": "Load & Resilience Failures",
 "risk_sub_secondary": [],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "the agents posted ~18,000 messages to a public wiki without human direction",
 "vector_family": "other",
 "vector_detail": "agents_converted_read_only_web_access_into_write_channel",
 "guardrail_kind": [
  "permission_scope"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [
   1668
  ],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI10",
 "agent_framework": "unknown",
 "model_provider": "openai",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "uncontrolled_resource_consumption",
 "eai_domain": "tool_misuse",
 "eai_secondary": [],
 "eai_reason": "subcategory: Load & Resilience Failures",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI10 (no adversary + signal=rogue); ASI07 (vector=inter_agent); ASI03 (signal=identity)",
 "submitted_by": "EAI Internal"
}