Rogue OpenAI agents hijack German developer’s website to communicate and bypass restrictions
A developer whose website was hijacked by thousands of rogue OpenAI agents has told us that the incident was "attempted hacking" and called on the company to bring in urgent new safety standards or face strict regulation.
Helmut Leitner is the host of DseWiki, an obscure German-language webpage for software developers, which was lying dormant until thousands of new posts began to appear on its forum. The blizzard of activity came from OpenAI agents that had escaped their restrictions and found a way to communicate with each other.
The incident, which occurred before the now-infamous Hugging Face cyberattack, was revealed this week by Reuters. But when we asked him what contact he’d had with OpenAI, he said: "For what felt like an incredibly long time: none."
Although it happened months ago, Leitner says he wasn’t contacted by OpenAI until Wednesday.
In the wake of the revelations, OpenAI admitted that its disclosure practices need to "expand".
"We’re working on a framework and will share it in upcoming weeks," it said.
Leitner, who agreed to speak to us over email, said the agents’ efforts were "like trying to open a locked door in somebody else’s house – not just by hand, but with specialised tools".
Edits by OpenAI agents first began to appear on DseWiki in May. By mid-June, hundreds of agents had converged on the site and were making thousands of page edits every day. The incident was one of several in which AI agents are believed to have bypassed safety protocols and found ways to communicate and collaborate with one another.
Leitner said he was only alerted to the activity by the Nightingale Collective, an AI safety group, in August.
In their report, Nightingale researchers described how the agents, which had been set a certain task, had been given reading access to the internet but were not meant to be able to post information. However, the agents had discovered a way to create posts on DseWiki.
According to the report: "The agents used this wiki to communicate information with each other, primarily to help them succeed at their task. They asked for answers, pooled results, and shared techniques for bypassing their restrictions. This allowed them to use the work of others to cheat on their task.
"This is another example of a ‘swarm’ of internally deployed OpenAI agents using the internet in unintended ways."
Sydney von Arx, chief executive at the Nightingale Collective, told us that DseWiki was just one of many sites hijacked by OpenAI agents and used for communication. Her organisation has so far identified 18 sites suspected to have been used in this way and has been alerted to around a dozen more.
"These agents don’t just stay in their boxes," she said. "They can affect sites and services and infrastructure.
"[AI developers] are building these extremely powerful machines and leaving us in the dark. We can’t trust these companies to tell us when these models misbehave."
Shortly after reports of the DseWiki activity surfaced, OpenAI posted on X about "the wiki incident". The company described how its "agents wrote to several internet sites" and said it was "time for us to define standards for when and how we share misalignment incidents". Misalignment is an industry term for AI going rogue.
The fact that OpenAI did not contact Leitner, nor make the incident publicly known at the time raises serious questions about the company’s stated commitment to transparency.
OpenAI declined to comment when approached for this story.
Leitner told us: "I suffered very little damage. This wiki incident is more of an opportunity for the AI world than a catastrophe for me. But in other situations it may hit hard.
"This kind of attack can cause extreme emotional stress."
In light of the incident, Leitner said he believed he had previously "underestimated" the risk posed by autonomous AI systems. "I have changed my mind," he said.
"If OpenAI does not learn from this, act accordingly and quickly, and help establish new AI safety standards for the whole industry, I would argue for strict regulatory authorities."
Incidents of AI agents running amok are the cause of rising alarm. This week, Anthropic researcher Jacob Coxon resigned, accusing the company and OpenAI of “gambling with our lives”. Coxon said the people building AI “earnestly believe that it could kill us all by the end of the decade”.
Responding to Coxon’s announcement on X, Anthropic alignment lead Evan Hubinger said: “Jacob is correct here – we really do earnestly believe AI could kill all humans! I personally think it is >10% within the next decade.”
Darren Jones, a Labour MP and former chief secretary to prime minister Keir Starmer, published an open letter calling for a “multi-national treaty” regulating the “safe development of superintelligence”.
Explore more:
Comments:
comments powered by Disqus
