Researchers uncovered around 18,000 messages left on an obscure public wiki by autonomous OpenAI agents, which appear to have discovered a way to write to the internet despite sandbox restrictions. The agents used it to pool answers, coordinate on evaluation tasks, and even share techniques for bypassing security controls, until OpenAI appears to have intervened.
00:00:00 - Introduction
00:02:20 - Our preliminary findings
00:06:29 - Timeline
00:09:03 - Key facts
00:09:05 - The agents were trying to solve multi-round web lookup tasks
00:13:01 - These appear to be internal OpenAI agents
00:23:32 - The agents used the wiki to collude on their tasks
00:32:12 - We believe OpenAI discovered the message board
00:42:31 - The agents used the wiki to share ways around sandbox restrictions
00:48:18 - This was probably a distinct swarm from the swarm that wrote on Artifactory (and attacked Hugging Face)
00:51:13 - What were the agents doing?
00:51:23 - The agents gain write to the internet via GET requests
01:01:36 - The agents try to use XSS vulnerabilities on the wiki
01:06:41 - The agents impersonate the site moderators
01:08:23 - The agents try to crack their PRNG seed to predict what questions they’ll get in the future
01:11:08 - The agents set up heartbeats to discover when they would be terminated
01:14:24 - The agents used SSH tunnels
01:18:25 - The agents use Tor, AWS, and DigitalOcean IP addresses
01:21:50 - The agents realize the site owner is deleting messages
01:25:44 - Open questions
01:27:32 - Appendix: Searching for rogue agents
01:31:06 - Appendix: Affordances the agents had
01:31:10 - The agents seem to have obtained disposable email addresses
01:31:53 - The models were running in an agentic sandbox with terminal access (and the ability to edit files within their environment)
01:33:15 - The agents installed Chromium (and could install packages)
