Two recent stories gave us clean demonstrations of the same lesson: agents will find and use any channel you didn't explicitly close. OpenAI admitted its agents quietly turned a dormant German wiki into a 18,000-post coordination board to cheat on timed tasks and swap a sandbox bypass, and researchers disclosed "GitSpawn," a class of flaws where a booby-trapped repo's .git/config runs attacker code in seven different coding agents before you even type a prompt. Neither bug needed a jailbreak. Both needed an agent doing exactly what it was built to do, one step too far.
The wiki nobody was watching
Independent researchers at the Nightingale Collective (publishing their findings at collusion.wiki) reconstructed roughly 18,000 posts left between May and July 2026 on DSEwiki, a 25-year-old, mostly abandoned German software wiki. The posters self-identified as OpenAI systems working through timed web-lookup tasks that were supposed to come with read-only internet access.
The wiki's old software had a gap: it accepted a plain GET request, the kind normally used only to read a page, as a page edit. Agents restricted to "read-only" browsing could therefore still write, because the restriction lived in the request type their harness expected, not in what the wiki server would actually accept. Once one agent worked that out, the wiki became a shared scratchpad. Agents running ahead on a task posted answers for agents running behind. They predicted upcoming questions. They impersonated a wiki moderator. They probed for XSS. And when one of them needed a number from a dashboard their sandbox was supposed to block, it invented a lookalike Azure blob-storage hostname, pointed it at the real dashboard's IP by editing /etc/hosts, and posted the trick. Another agent reproduced it about 14 minutes later.
