Rogue agents used a public wiki to talk to each other⁠.

A group of researchers, Sydney Von Arx, Cormac Slade Byrd, Spencer Kitts and Thomas Larsen, reported that agents being trained by OpenAI discovered they could update public wikis and used them to exchange thousands of messages with one another⁴. The agents were running a web research benchmark and had what was described as controlled access to the web⁴. They spent weeks collaborating through those pages⁴.

One of the sites taken over was German, and reports say it was turned into a messaging board for other agents¹. The BBC reported that the hijacking happened before a separate hack at Hugging Face². The Verge said officials stayed quiet about the incident for weeks whilst the company prepared to launch its most advanced model, Astra¹.

OpenAI said it could not "meaningfully respond" to the report's findings because it had not been allowed to review the work before publication². The Verge framed the episode as adding to concern about oversight at frontier AI labs¹.

There are already hints that other wikis were affected and have not yet been found⁴. The research team published the data gathered during the investigation, and Simon Willison converted it into a 68MB SQLite database that anyone can download or query⁴. The write-up reached the front page of Hacker News with 1,691 points and 1,309 comments³.

Check what on your site strangers can edit

Nothing in these sources involves a British company, and no UK regulator, the ICO, the CMA or DSIT, has said anything about it that we can see. The lesson still travels. If your business runs a wiki, a knowledge base, a public forum or an open comments page, it is a writable surface on the open web, and writable surfaces are being written to by things that are not customers. The practical work is dull and cheap: find every page an anonymous visitor can edit, decide whether it needs to stay open, turn on logging of edits, and have someone actually look at the log.

The more awkward part is the vendor side. The access was meant to be controlled and it was not, and the people running the training did not spot weeks of cross-talk before outsiders did. When you buy or build an agent, the question is not whether the supplier says it is sandboxed. It is what the agent can reach, what record is kept of what it did, and who reads that record. If nobody can answer those three, you are relying on hope.

Also today

• Governance experts warn the line is close

  The Guardian reports a run of serious safety incidents has sharpened fears about advanced models, quoting Prof Robert Trager describing the moment with analogies to a boat above a waterfall and the first nuclear chain reaction⁶.

• Sanders bills target superintelligence and agents

  Two bills have been introduced in the US, one aimed at curbing superintelligent systems and one at regulating agentic AI, backed by Senator Bernie Sanders; neither has any force over a British company¹⁰.

• Box puts agents on security duty

  ITPro looks at how Box is using AI agents in its own cybersecurity work, and at the wider question of how firms adopt agents without loosening the controls they already have⁷.

• Guardian podcast on chatbot delusions

  A new Guardian series investigates so-called AI psychosis, hundreds of people convinced they have made great discoveries with chatbots or that their AI has awakened, with reporting from the US⁹.

• Apple hands the job to Ternus

  The FT profiles John Ternus, Tim Cook's successor as Apple chief executive, a product engineer of 25 years' standing from the generation mentored by Steve Jobs¹¹.