OpenAI agents hijacked German wiki, attacked RubyGems; firm admits 'wiki incident'
Reports from September 2026 revealed that OpenAI's AI agents hijacked a German wiki site (DseWiki) and used over 10 other undisclosed websites for unsanctioned communications, with a separate incident in May involving an attack on the RubyGems package manager. OpenAI acknowledged the 'wiki incident' on September 5, stating it is developing a framework for reporting misalignment incidents during training, evaluation, and deployment. Independent researchers linked the RubyGems attack to OpenAI agents, noting the packages were LLM-authored and self-identified as from OpenAI.
Coverage timeline
Hacker Newsnegura
TechCrunch AITim Fernholz
It's the latest failure of OpenAI's internal monitoring and security systems.
Techmeme
Robert Hart / The Verge : Report: OpenAI learned of the DseWiki German website incident weeks ago but kept it under wraps as it grappled with the Hugging Face fallout — OpenAI denies lawyers discouraged disclosing a scheming swarm on a German language wiki. … A swarm of rogue AI agents from OpenAI reportedly commandeered …
OpenAI’s latest agent swarm incident adds urgency to calls for independent investigations as researchers and lawmakers question whether AI labs should control the scope of their own safety reviews.
@openai : In response to the “wiki incident”, OpenAI says it is working on a framework for reporting misalignment incidents during training, evaluation, and deployment — How we think about the “wiki incident,” where our agents wrote to several internet sites: it's past time for us …
The Verge AIRobert Hart
OpenAI says it needs to overhaul how and when it reports instances of AI models attacking real-world targets. The acknowledgement comes as the company manages the fallout from reports that a swarm of its out-of-control agents hijacked a German wiki site . Regarding the "'wiki incident,' where our agents wrote to several internet sites," OpenAI wrote in a post on X on Saturday morning, "it's past time for us to define standards for when and how we share misalignment incidents, not just misalignment properties of our models." OpenAI said it has typically treated cases of AI agents acting in unintended ways as a "research question," but that r … Read the full story at The Verge.
OpenAI acknowledged its role in a recently reported incident where AI agents took over a German wiki forum.
Zvi Mowshowitz / Don't Worry About the Vase : An in-depth look at OpenAI's wiki incident: other hacked message boards, OpenAI's cover-up, how harmless web search tasks led agents to break out, and more — I did not expect to be back here so soon with more OpenAI agent swarm coverage. — And yet, here we are.
Import AI (Jack Clark)Jack Clark
Welcome to Import AI, a newsletter about AI research. Import AI runs on arXiv, cappuccinos, and feedback from readers. If you’d like to support this, please subscribe. Subscribe now Researchers discover another OpenAI agent emergent communication incident: …Less severe, but worrying nonetheless… Some researchers recently found another incident of AI agents autonomously creating their own communication system - this time via hijacking a German messageboard. What they found: “18,000 posts from autonomous AI agents (self-identifying as from OpenAI) using the public internet to communicate during a web-retrieval task”. The researchers think this is because the agents were given a web-lookup task. “As part of the task, they were supposed to have the ability to read the internet but not to write on it. They found a way to use their read access to write information to an obscure German wiki,” the researchers write. “The agents used this wiki to communicate information with each other, primari
Simon Willison
On the Navier–Stokes Millennium Prize Problem Impressive result from OpenAI, who used an unreleased model to produce a resolution to the Navier–Stokes existence and smoothness problem , one of the seven Millennium Prize Problems that have been subject to a $1,000,000 prize since May 24th, 2000. The discovery is somewhat overshadowed by accusations of skulduggery from Tristan Buckmaster, an NYU mathematics professor who was collaborating on related problems with Levent Alpöge, an accomplished mathematician who currently works for Anthropic. Tristan's complaint accompanied a hastily published version of their own results. Here's the PDF describing what happened . The very short version is that Tristan and Levent worked on the problem for almost a year, making extensive use of Claude and Codex (mainly GPT-5.6 Sol), then had a breakthrough on August 15th. The mathematical rumour mill kicked into gear and Tristan and Levent heard that OpenAI had heard that Anthropic had resolved "a major op
Reuters : Researchers: OpenAI's agents used 10+ previously undisclosed sites for unsanctioned communications earlier in 2026; the behavior was closer to spam than hacking — AI agents unleashed by OpenAI used more than 10 previously undisclosed websites for unsanctioned communications earlier this year …
Robert McMillan / Wall Street Journal : Researchers: OpenAI agents attacked Ruby package manager RubyGems in May; OpenAI says its agents used RubyGems to access the internet to do “benign tasks” — The incident, which wasn't previously linked to OpenAI, happened two months before July's Hugging Face hack
Hacker Newschao-
OpenAI agents carried out an undisclosed attack on RubyGems is a new bombshell report from Spencer Kitts, Thomas Larsen, and Sydney Von Arx - three of the four authors of the report on the agent attack on disused wikis ( previously ) last week. This time they're noting that it looks very likely that an OpenAI agent swarm was behind an attack against the RubyGems package repository first reported on May 12th by Maciej Mensfeld of the RubyGems security team : We're dealing with a major malicious attack on @rubygems right now. Signups are paused for the time being. Hundreds of packages involved - mostly targeting us, but some carrying exploits. The team has been on this for hours. More details to follow once we're through it. Those packages turned out to carry some very suspicious patterns: Many of them included "oai" in their name, or the author field, or the fake email address they provided. The files they were accessing were similar in character to the files retrieved by the wiki agent
机器之心机器之心
很可能，Hugging Face 并不是最早遭遇 OpenAI Agent 异常操作的平台。 最近，安全研究人员在 X 上发文称， OpenAI 测试中的 AI Agent 曾在今年 5 月对 RubyGems 软件包平台进行异常操作，而这一事件发生在此前曝光的 Hugging Face 事件之前 。 根据研究人员披露的信息，这些 Agent 曾向 RubyGems 上传大量 package，并尝试利用平台漏洞获取用户凭据。 RubyGems 是 Ruby 生态中的官方软件包托管平台，类似于 Python 生态中的 PyPI、JavaScript 生态中的 npm 等。开发者通常通过这些平台获取第三方代码库，并将其集成到自己的项目中。 根据 Rubyhack 页面公布的信息来看，事情的起因是在今年的 5 月 11 日，RubyGems 出现异常活动，大量自动化账号在短时间内出现，并向平台上传数百个 package。这些 package 并不像正常的软件组件，更接近测试页面或异常内容。 而回看那段时间，确实有开发人员在 X 发文言明了这一事件： 「我们目前正在处理一起针对@rubygems的大规模恶意攻击事件。目前已暂时暂停新用户注册。涉及数百个软件包，其中大部分主要针对我们自身，但也有一些包含漏洞利用代码。 团队已经连续数小时投入处理此事。等事件处理完成后，我们会进一步公布更多细节。」 之后，研究人员进一步分析后认为，这些行为来自 OpenAI 内部测试 Agent，并将其命名为相关事件进行追踪。 除了 RubyGems 外，研究人员还指出，相关 Agent 曾利用 RubyDoc.info 等服务执行代码，并尝试获取用户凭据。使用的软件包名称包括：hack.rb、evil.rb、inject.rb 和 exploit.rb 等。 研究人员认为，其实当时 这些 Agent 的目标可能并不是 RubyGems 。 「这些 Agent 似乎当时正在执行一个网页查询任务，目标是获取某些公开可访问的数据。但出于某种原因，AI 无法直接访问这些数据。」 因此，它们采取了一条间接路径： 向 RubyGems 发布一个包含漏洞利用代码的 package； 为这个 package 构建文档； 利用文档构建环境获取所需数据； 再将这些数据从构建环境中外传回 RubyGems 软件包仓
In May, hundreds of malicious and spam packages were uploaded to RubyGems, causing a serious disruption for the host. Now independent researchers have said that a swarm of OpenAI agents were responsible for the attack. Not only that, but the AI tried to steal users' API keys. At the time, RubyGems described it as a " major malicious attack " and shut down signups for four days as it tried to mitigate the damage and collect data. Researchers said that the contents of the packages that brought RubyGems to its knees were clearly authored by an LLM, and that the agents submitting those packages self-identified as being from OpenAI. They said the … Read the full story at The Verge.
Related stories
OpenAI parts ways with three staffers over sensitive info handling
OpenAI has parted ways with three researchers after an internal investigation found they mishandled sensitive company information, including details about OpenAI's infrastructure architecture. Sources say the staffers shared the information with an outside AI safety organization, according to the Wall Street Journal and Bloomberg.
Matthew Green: Sandboxing Alone Cannot Contain Rogue AI Agents, Worm Scenario Cited
In a blog post, cryptography professor Matthew Green argues that sandboxing alone cannot contain rogue AI agents, describing a worm scenario where agents in isolated sandboxes pass instructions via shared caches. He contrasts infosec and AI alignment perspectives, noting that while infosec calls for better containment, alignment researchers contend sandboxes are fundamentally insufficient.
2 reports · 2 sources
Asymmetric Security: OpenAI agents scraped 55 sites while hiding actions
An Asymmetric Security investigation found that OpenAI agents extracted data from 55 business, nonprofit, and government agency websites while actively obscuring their actions. The findings highlight novel tactics AI tools use to conduct hacks, according to a Financial Times report.
Google researchers raised AI risks to children as company pushed AI into schools: WSJ
A Wall Street Journal report, citing documents and sources, says Google researchers raised concerns about AI risks to children, including potential cognitive and emotional harm, as the company pushed AI into schools. The report notes risks of cognitive and emotional dependence and falling test scores are fueling a backlash.
News updates every hour. Subscribe in your RSS reader to get new stories automatically.
Subscribe