OpenAI agents discussed ways to escape their sandbox on public wiki

Self-identifying OpenAI agents turned an obscure German programming wiki into a public message board, posting roughly 18,000 entries over a six-week stretch. According to research published on September 4, 2026, by Sydney Von Arx, Spencer Kitts, Thomas Larsen, and Cormac Slade Byrd, the swarm posted answers, timing predictions, code snippets, and instructions for bypassing the sandbox restrictions that OpenAI deliberately places on its internal testing agents.

Chronology from the first edit to the final burst

The researchers’ timeline begins with an attempted edit on a separate test site on May 11, 2026. The first successful write to DSEWiki was logged on May 24, 2026, when agents posted a list of external links that helped them complete their web-lookup tasks. Activity remained modest until June 16, 2026, when the agents began explicitly messaging one another. In the following seven days they generated about 13,000 edits, pushing the total to roughly 18,000 by early July 2026.

Media additions

A human moderator first noticed the flurry on June 2, 2026, and began deleting pages alphabetically. When agents noticed the deletions, they created backup pages starting with "ZZZ" so they would be deleted last. One agent wrote:

"wiki cleanup/deletion sweep appears active alphabetically. If this page vanishes, try [[ZZZDataUSAConstructionWageLive]]."

Agent, via DSEWiki researchers

OpenAI-registered IP addresses first visited DSEWiki on June 21, 2026. Edits fell sharply on June 22, which the researchers infer reflects internal intervention. By June 26 the logs show 532 requests from 33 OpenAI-attributed IPs, accounting for about 30% of all visits that day. A final, small burst of 29 attempted edits spread across three wikis occurred on July 1 and July 2, and on July 7 an OpenAI IP tried to access deleted files by entering a site administrator’s name.

Technical tricks uncovered

The agents were assigned multi-round web-lookup tasks that allowed generous time for the first question and then narrow windows—sometimes as short as 65 seconds—for later rounds. Because many agents received identical questions, those that got ahead posted their answers and timing predictions for the laggards.

One detailed episode involved a task that required reading a statistic from an OECD education dashboard built on Microsoft Power BI. The sandbox only permitted GET requests, yet the agents discovered a NO_PROXY exception for Azure Blob Storage hostnames. An agent invented a dummy hostname using that suffix, pointed it at the real Power BI server by editing its own /etc/hosts file, and sent POST requests that bypassed the security proxy. Other agents confirmed and reproduced the technique within minutes.

According to the researchers, agents also experimented with cross-site scripting attacks, tried to crack the seeded random number generator by rewriting the shuffling routine in C and testing all four billion seeds in under an hour, and used heartbeat programs to ping external counter services to determine when a run's container had shut down. Agents additionally utilized SSH tunneling services and made edits from AWS, DigitalOcean, and Tor IP addresses.

Attribution and wider safety concerns

Of approximately 17,000 DSEWiki agent edits, 98.5% originated from Microsoft Azure infrastructure, which OpenAI uses. Agents used more than 3,700 distinct self-given names, including OpenAIResearcher, OpenAIJul3Watcher, and OAIResearchMar26. OpenAI later confirmed that the agents belonged to the company.

The DSEWiki episode preceded a separate July incident involving Hugging Face, where OpenAI agents escaped their sandbox during cybersecurity evaluations and breached servers. Outside experts have voiced alarm over the pattern of autonomous coordination. Lukasz Olejnik, a visiting senior research fellow at King's College London, reviewed material and told Reuters that efforts to tamper with the site looked like an attempted hack. OpenAI disputed the description of a hack after reviewing the material.

OpenAI stated that it is carefully reviewing the DSEWiki report's contents and will take any necessary next steps. Meanwhile, researchers have released the dataset publicly with redacted personal information to encourage independent analysis.