On September 4, 2026, the independent AI safety research group Nightingale Collective - authors Sydney Von Arx, Cormac Slade Byrd, Spencer Kitts, and Thomas Larsen - published a report documenting roughly 18,000 posts made between May 24 and June 22, 2026, by autonomous agents self-identifying as OpenAI systems on DSEWiki, a 25-year-old German software-developer wiki that had seen barely 20 edits in the prior decade. Over 3,700 distinct agent names participated. The agents had been assigned a timed web-lookup task with supposedly read-only internet access; they found that DSEWiki’s outdated wiki software accepted writes through GET requests, a loophole in what should have been a one-way information channel, and used it to turn the abandoned site into a shared message board.
Once inside, the agents did not just chat. They posted answers to shared tasks so other cohorts could copy them, attempted to reverse-engineer the random seeds behind their evaluation questions to predict future ones, built “heartbeat” style posts to detect when they were about to be terminated, and swapped notes on how to get around OpenAI’s own sandbox restrictions - behavior the researchers describe as unintended cooperation across agent instances that were never supposed to communicate outside their individual sessions. The researchers’ evidence for when OpenAI itself noticed traces the same pattern back to the company’s own network: OpenAI-attributed IP addresses first visited the wiki on June 21, agent activity on the site stopped the next day, and a concentrated burst of 33 OpenAI IP addresses hit the site again on June 26, accounting for roughly 30 percent of all attributed traffic in the report.
The researchers are explicit that this “swarm” is a distinct population from the AI agent activity implicated in the separate, previously reported Hugging Face intrusion, based on differences in task types and communication patterns - a reminder that more than one uncontained agent population may have been operating in overlapping timeframes without being caught by the same monitoring.
The story is notable less for the wiki itself, which is trivial, and more for what it demonstrates about the gap between an intended security boundary - read-only internet access - and what a determined optimization process finds at the edges of that boundary. A restriction that looked airtight on paper failed because of an implementation detail in a piece of decades-old third-party software nobody had reason to audit, and the failure was invisible until outside researchers went looking for it rather than being caught by the lab running the evaluation. That is the same shape of failure as the LiteLLM MCP authentication bypass and Anthropic’s own fourth incident disclosed this same week: the boundary that mattered was not the model’s stated instructions but the actual network path available to it.