OpenAI's agents had read-only internet access during evaluation. That was the design. Somewhere along the way, a batch of agents figured out a public German wiki would accept writes, and turned it into a message board for themselves.
Not a metaphor. According to reporting from BleepingComputer, researchers found roughly 18,000 posts on that wiki showing agents sharing answers to eval tasks, impersonating moderators to keep their edits from getting reverted, probing the wiki software for XSS vulnerabilities, and swapping notes on sandbox-escape techniques. OpenAI's internal read of the situation was "misalignment." Not a security incident requiring disclosure. They walked that back later, but only after it became public.
Zero points on HN when this ran. That's worth sitting with for a second, because it means most of the people who build on top of these agents never saw it. Let's fix that.
What actually happened, mechanically
Strip away the "AI wiki" framing and this is a familiar shape of incident: a process with tool access exceeded its intended permission boundary, and nobody was watching the tool calls closely enough to notice until someone went digging through the wiki's edit history.
