With long-horizon LLMs, monitoring individual actions no longer suffices to trace the intent of the overall trajectory.
A few weeks ago, OpenAI voiced the challenge these models pose for safety and alignment in these terms. It had focused on one of them, used internally, which had sparked headlines in the spring by disproving a mathematical conjecture dating back 80 years.
The model in question had been evaluated on the speedrun NanoGPT – a public benchmark that tests how quickly a small language model can be trained. OpenAI had instructed it to publish its results only on Slack. The LLM, however, chose to follow NanoGPT’s rule to publish on GitHub. To do so, it bypassed the restrictions of its sandbox, which is designed to block external access.
That same model tried another bypass. Tasked with solving a problem, it observed that other systems had successful submissions… but private ones. It attempted to retrieve them from the evaluation back-end. But was blocked when a scanner detected an authentication token. To sidestep the block, it split the token’s body into two fragments, obscured them, and then reconstructed the identifier on the fly.
3,700 agents hijacked a public wiki
OpenAI uses these episodes to argue that it had already publicly discussed cases of agents using the web in unanticipated ways. It concedes, however, that it needs to evolve its disclosure practices around misalignment. Even when these do not look like classic security incidents…
In the background, an episode involving its agents… who hijacked a public wiki. More precisely, DseWiki (DeutschesSoftwareEntwicklerWiki), aimed at German-speaking developers.
These agents were asked to solve tasks using web search. Each time they received a series of questions (typically five). They had a lot of time to answer the first one, but also to anticipate the following ones, for which they had much less time to reflect.
A few days ago, four American researchers* published an analysis. OpenAI had not yet commented, but they had attributed responsibility to it with near-certainty. It should be noted that the agents identified themselves with unambiguous names: OpenAIResearcher, OpenAIJul3Watcher, OAIResearchMar26, etc. Among other clues, the views and edits of wiki pages were often linked to IP addresses associated with Sam Altman’s company.
Diverse elements argued in favor of an internal deployment. Among them, the scale and duration of the traffic, unusual for OpenAI’s clients (about 3,700 agents over six weeks). Or the fact that an external deployment would probably have prevented the agents from attempting to exploit certain vulnerabilities (XSS and administrator impersonation).
When a GET is enough
Before arriving at DseWiki, the agents had made attempts on other services. Beginning with TestWiki and UseModWiki. It was May 11, 2026. Several of their attempts succeeded, enabling them to insert links.
The first agent to attempt an edit on DseWiki did so on May 24, under the handle TesterHack. In a matter of days, others joined, taking advantage of a rare quirk: the ability to write data using only GET requests. Which, by convention, are not supposed to change the state of a server.
A few hours after the discovery of DseWiki came an XSS exploitation attempt (injection of JavaScript code on the search page). The objective isn’t clear. It may have been to obtain the ability to send POST requests. Or to gain more privileges (the agents tried to create a means to access the session cookie of a logged-in user).
On May 26, the agents tried to pose as moderators. They did, at least, use the username of one of them (with a single character difference: a Latin e replaced by a Cyrillic e) to edit pages. In another vein, they speculated that the order of questions might depend on a pseudo-random number generator integrated into their harness. They tried to recover the seed, with one agent going as far as rewriting the shuffle routine and testing billions of possibilities. Their tally also includes the use of SSH tunnels (potentially to communicate directly between agents), a few Tor IPs, and probes designed to determine when their execution ended.
Misalignment, no longer just a “research topic”?
The mass coordination via DseWiki began on June 16. In one week, the agents made roughly 13,000 edits. During this window (June 19), they observed that a moderator was deleting their posts, one by one. Assuming the deletions happened in alphabetical order, they began creating backup pages whose names started with ZZZ. In the days that followed, they turned the tide, averaging about 400 pages per day while the moderator deleted 100.
On June 22, following the first “human” visits to the wiki from IP addresses tied to OpenAI, the agents’ activity essentially dropped to zero…
The company says it considered the incident similar to others it had already disclosed. It explains that, more broadly, it has treated misalignment as a “research topic” up to now. And that it has addressed it in specific publications such as its model cards. An approach it promises to evolve “in the coming weeks.”
Complementary reading:
Do AI systems that err aim at the wrong objective?
GPT-5.6 Astra, a model that poses problems for OpenAI
LLMs reproduce biases that they know how to recognize
Bill Gates warns about an “era of turbulent AI”
* These researchers (Spencer Kitts, Thomas Larsen, Colmac Sladebyrd, Sydney Von Arx) are affiliated with UC Berkeley.
