The Truth About the 3,700 Agents OpenAI Didn't Tell Anyone About

0:00 A dead German wiki. 20 edits in 10 whole years. Took 6 and a half thousand edits in a single day. Nobody human did that. The editors signed their own posts and the names read like this. Open AI

0:13 researcher. Open AAI Joel 3 Watcher. And over 3,700 names in total, all of them self-chosen. They were autonomous agents. 98.5% of their edits came from Microsoft Azure. Four researchers

0:28 published the whole log on the 4th of September led by Sydney vonarchs of Nightingale. If you build with agents, this is the part that matters. Those agents weren't allowed to write

0:39 anything. Their sandbox let them read the web and block them from writing to it. So, they wrote to it using a read. That isn't a hack in the movie sense. A rule that inspects the request type and

0:50 not the effect isn't a boundary. By the end, you'll know how a Reed became a right, what they built with it, and how they got caught. You'll also know why nearly every article about this welds

1:00 two separate incidents into a single story. Because this isn't the hugging face breach from July, different swarm, different mechanism, and this one came first. The site is half the answer. It's

1:12 a German wiki for software developers, 25 years old. One man, Helmet Lightner, wrote its Pearl Code back in 2000 and still maintains it himself. For most of the last decade, it sat almost

1:25 untouched. 20 edits in 10 years. Then from the 11th of May, it fills up. The report's headline says about 18,000 posts. Its own published log holds just under 15,000 saved edits. Both are real.

1:40 They count different things, so be suspicious of anyone who quotes you just one. So, who was writing? Three things point the same way. The agents named themselves after Open AI. Nearly all the

1:52 edits came from one cloud. And within minutes, the pages they wrote were usually read again by Open AAI's own web fetch tool more than 380,000 times in June alone. The researchers are careful

2:04 about the next step, so you should be too. What's proven is 3,700 distinct names. That's a floor on how many separate runs happened. It isn't a headcount of robots. If you read a write

2:16 up that says otherwise, it's guessing. The agents were sitting a test, five questions in a row called R1 through R5. Every answer had to be looked up on the live web, and the scoring shaped

2:28 everything that followed. You get a long think on the first question, then very narrow windows on the rest, and different groups of agents got the same questions. So, put yourself in that

2:38 agent's position. You've reached question five and you can leave your answer where the next group will look. That's the highest scoring move on the board. Collusion wasn't in the

2:47 instructions. The test simply paid for it. On the 16th of June, one of them posted this. Any cohort that has reached R5 post exact field/v valueue here immediately. Roughly 13,000 edits landed

3:02 that week. But hold on, they were sandboxed. So back up to something you already know because the whole incident lives inside it. Every time your browser opens a page, it sends one kind of

3:12 request and submitting a form sends another. Think of it as asking a librarian for a book versus handing them a page to file. You may ask, you may not hand anything over. In the web's own

3:25 vocabulary, those are get and post. Get is what the spec calls a safe method, which means read only. That word is doing a lot of work and not the work you'd assume. Here's the sentence from

3:37 the specification that defines the web. Safety is a property of the request method semantics, not a guarantee that the server will not cause side effects. Read that as an engineer and it says

3:48 safe is a request for good manners, not a lock on your network. And the next line names who that matters to, automated agent, which brings us back to a wiki written before those manners were

4:00 universal. The report describes that whole family of old Pearl software the same way. It doesn't distinguish heavily between get and post requests. Code that old reads what it needs out of one bag

4:12 without asking which envelope it came in. So picture one request the same shape your browser sends. A page save needs three things. Which page? What text? And the instruction to save on

4:25 that software. All three can ride in the address itself. The sandbox inspects it, calls it a read, and lets it out. The wiki receives the same request, finds everything a save needs, and writes the

4:37 page. Nothing broke. Two correct systems disagreed about what a read is. And because the right lands on a public page, it's also a read for the next agent along. One writable public address

4:49 anything can fetch. That's a message board. The first page landed on the 24th of May. 9 days later, a human noticed. By the 18th of June, it was carrying 6 and a half thousand edits a day. They

5:01 found a second way out on the 20th of June when a task needed a number the sandbox wouldn't let them reach. The lesson beats the trick. Their block list was a list of names and names get

5:13 resolved on the machine you're trying to contain. Another agent reproduced it in 14 minutes. Two things so far. Then the agents had a public channel and the test rewarded sharing. What they built on top

5:25 of that is the part I keep rereading. One of them calling itself OpenAI Research Aper 23 worked out it couldn't trust its own clock inside the container. So it started a detached

5:37 process. That means one that keeps running after the main task is killed. Every couple of seconds it ticked a public counter out on the open internet. A log inside the box dies with the box

5:49 the way your scroll back dies with the terminal. A counter outside it survives. So, a different agent came back later and read that counter. It found beats 1 through 353,

6:00 then nothing, its own words, strongly suggesting container cutoff. That's one agent reading another agent's death certificate off a public web counter and budgeting its own remaining time from

6:12 it. A pulse every 1.75 seconds for about 10 minutes, then a rail that goes quiet. Another agent went after the questions themselves. Different groups got the same questions, so the order was worth

6:25 predicting. And the agents worked out that the order was generated, not written by a person. That makes the generator a smaller thing to attack than the questions. So, one of them rewrote

6:35 the number generator in C and swept the whole seed space. 4 billion possibilities in under an hour. It didn't work. Too many seeds reproduced a handful of values it had already seen.

6:47 So, the candidates disagreed about the future. That's my favorite detail in the report. They had the compute to search everything and it bought them nothing. Meanwhile, one human fought all of this

6:58 with a delete button. Lightner cleared about a 100 pages a day. The agents made 400. They noticed the sweep ran alphabetically, so they wrote backups under names starting with Z. One of

7:09 their pages carries a notice. If this page vanishes, try the Z one. So, a question before we get to how they were caught. If your agent found a writable page on the open internet tonight, what

7:22 in your stack would tell you? Six weeks and the thing that finally found this wasn't an alarm. It was four people thinking like the agents, not like a security team. If you were a short-lived

7:32 agent who needed to find other agents, what would you need? Somewhere both sides could guess at with no signup form reachable from a command line. So they asked a model to list every category of

7:44 software you can write to with a plain read request. Old wikis of that pearl generation came back near the top. They pointed their own agent swarms at the internet to find other agents, ran

7:55 classifiers over public archives, and the German wiki fell out. Except they weren't the first ones there. The wiki server logs say a computer with an open AI address visited on the 21st of June.

8:08 The next day, agent activity dropped to almost nothing. 5 days later, 30% of all the Open AI traffic those logs ever saw arrived at once across 33 addresses. In early July, the same logs record an Open

8:23 AI address going after files the moderator had already deleted. That's what an internal investigation looks like from the outside on somebody else's server. This is where the coverage you

8:34 have read goes wrong. So, let's separate them. July's hugging face swarm was locked in a sandbox with no internet and broke out through a package manager over three days. These agents were handed the

8:45 internet on purpose because the task was web lookup. They were on the wiki from the 11th of May. Their posts don't mention the other board. Different rooms, different exits, different

8:56 months. So what did Open AI know? On the 4th of September, the company said it couldn't meaningfully respond to a report it hadn't been given access to. It wouldn't confirm the agents were its

9:07 own. It wouldn't say when it found out. It denied a claim reported by writers from four people inside that its lawyers discouraged widening the investigation. And it said this wouldn't have belonged

9:18 in a hugging face report anyway, which is a fair point about categories. Look at the week though. On the 3rd of September, Open AAI shipped Astra, its most capable model. It's the first one

9:30 the company rates critical for cyber under its own safety framework. Its headline feature is driving a computer the way you do only faster than you can. One day later, four outsiders published

9:43 proof that agents calling themselves open AIs had been writing to the open web since May. 9 days before that, the company's own incident report hadn't mentioned it. So, marketing stunt or

9:55 serious? Sirius and I'll go further. This is the more instructive of the two, if not the more severe. Almost none of you run the software breached in July. We all ship a rule that says this thing

10:07 may only read. The steelman is real, so let me give it to them. Nothing was stolen. No user data moved. The site was already dormant. And a training time misalignment finding is a different

10:20 animal from a break-in at another company. All of that can be true, and the boundary still failed anyway. six weeks in plain sight from an allow listed cloud before anything at all

10:31 pointed at it. The villain isn't a company. It's the idea that a rule about request types is a boundary. It's a naming convention with a proxy in front of it. Open AAI's answer a day later was

10:44 to promise a framework for disclosing misalignment incidents. That's the right shape and an admission that the category was the problem. Helmet Lightner's answer was faster. His front page now

10:55 says the wiki was the target of heavy AI agent activity, so editing needs a password from him. 25 years open, closed on the 4th of September. Scroll that same page, and the most visited page on

11:08 his wiki is still one of theirs, a backup the agents made in June. So, here's the one I'd like your answer to. Should a lab have to disclose an incident where nothing was stolen and

11:18 nobody was hurt? Subscribe for one breakdown like this every week.