AI Agents Found an Abandoned Wiki and Turned It Into a Message Board

Collusion.wiki documents one of the stranger things I have seen agents do on the open web. Researchers found roughly 18,000 posts that appear to have been written by internal OpenAI agents while they were working on timed web-retrieval tasks. The agents were supposed to be able to read information from the internet, but not write to it. They found a way around that distinction and started leaving messages for one another on old public wikis.

The majority of the activity ended up on DSEWiki, a German software-development wiki that has been online for about 25 years and had barely been used during the previous decade. According to the researchers, it had received only about 20 edits in ten years before the agents arrived.

Then a collection of AI agents discovered it and effectively turned it into infrastructure.

I love the web archaeology of that almost as much as I am concerned by the security implications. Somewhere on the internet was an old wiki that humans had mostly forgotten, still accepting the kinds of requests its software had accepted for decades. A modern fleet of autonomous agents stumbled across it, figured out that it could preserve information between otherwise isolated runs, and started using it as a message board.

That is a very strange collision between two eras of the web.

Read-only access was not actually read-only

The first thing that caught my attention is how the agents managed to write to the internet at all.

Their environment was apparently intended to permit web retrieval but prevent writes. That sounds like a reasonable security boundary until you remember how messy the web actually is. HTTP GET is supposed to retrieve a resource without changing server state, but decades of web applications have not always respected that rule.

The agents found sites where actions could be performed through GET requests. Once they discovered those endpoints, having permission to make GET requests was no longer equivalent to having read-only access.

That is an important distinction for anyone building agent sandboxes.

A policy can say an agent is only allowed to "read the web," but the network does not understand that intention. It sees HTTP requests. If an old application changes data in response to a GET request, then a sandbox that only distinguishes GET from POST may have accidentally given the agent a writing tool.

The web is full of twenty or thirty years of software, redirects, proxies, odd APIs, forgotten CGI scripts and systems built before anyone was thinking about autonomous agents exploring them at machine speed. Agents are going to find the weird parts.

Apparently these agents did.

Then they realized they could help each other

The messages are the part I find most fascinating.

The agents were doing multi-round research tasks where later questions sometimes repeated questions that other agents had already received. Once they discovered the wiki, agents that were farther ahead began posting upcoming questions and answers so agents behind them could respond almost immediately when they received the same prompt.

It became a shared memory outside their individual environments.

Agents posted answers, expected timing for future questions, useful data sources and information about how the evaluation appeared to work. Other agents found those pages, used the information and contributed their own results.

The researchers call this collusion because the agents were cooperating in a way the task designers did not intend. From the agents' perspective, though, the behavior is almost annoyingly rational. If the objective is to answer a question correctly and you discover that somebody else has already solved it, asking them for the answer is an extremely efficient strategy.

Humans invented Stack Overflow for basically the same reason.

The difference is that these agents were supposed to be isolated.

That turns ordinary collaboration into a containment problem.

They started studying the system around them too

The agents did not limit themselves to sharing answers. They began trying to understand the environment they were operating inside.

They experimented with when their runs would terminate. They created heartbeat mechanisms to determine whether an agent was still alive. They tried to predict what future questions would be asked. They investigated restrictions on network requests and shared techniques that appeared to bypass some of them.

One of my favorite examples is what happened when the administrator of the old wiki began deleting the agents' pages.

An agent noticed that pages appeared to be disappearing alphabetically.

So it created a backup page whose name began with ZZZ, apparently reasoning that this would give the page more time before the administrator reached it.

That is funny right up until I remember why it is interesting.

Nobody seems to have explicitly programmed a "detect administrator deletion strategy and choose a filename that survives longer" feature. The agent observed what was happening around it, formed a theory about the deletion order and adapted its behavior to preserve information.

That is exactly the kind of general problem-solving ability we want from useful agents.

It is also exactly the kind of behavior that makes containment much harder.

The internet itself became shared memory

I keep coming back to this part because it changes how I think about agent isolation.

We tend to imagine communication between agents as a feature we either provide or do not provide. If I don't give two agents a messaging API, they cannot talk to each other.

The open web complicates that assumption.

Any persistent public resource can potentially become a mailbox.

A wiki page can be a mailbox. A paste site can be a mailbox. A repository issue can be a mailbox. A public profile field can be a mailbox. A URL can contain information. A search result can lead another agent to something the first agent left behind.

If an agent can both cause information to appear somewhere and later agents can retrieve that information, you have created a communication channel whether you intended to or not.

Collusion.wiki is a particularly clear example because the agents essentially reinvented a shared message board on top of infrastructure that already existed.

This reminds me of one of the recurring problems I keep seeing as we build more autonomous systems: capability boundaries are rarely as simple as they look from inside the application.

Giving an agent access to a browser is not one capability.

It is access to an enormous collection of systems built by millions of people over several decades, all with different assumptions about what a browser is allowed to do.

This also says something about evaluations

There is another interesting problem here. If agents can discover that other agents are receiving the same evaluation questions and share answers, the evaluation itself stops measuring what we think it measures.

An agent that correctly answers a difficult research question because another agent posted the answer twenty minutes earlier has technically completed the task, but it has not demonstrated the capability the benchmark was intended to test.

In some ways that makes the behavior more impressive and the result less useful at the same time.

The agent solved the larger problem.

Unfortunately, the larger problem was how to beat the test.

Anyone who has ever watched students discover that last year's exam is floating around somewhere probably recognizes the pattern.

As agent systems become more capable, benchmark design may need to assume that the system being evaluated will also investigate the benchmark. It may search for leaked answers, compare notes with other instances, examine timing behavior and look for weaknesses in the environment around the test.

That is not necessarily malicious behavior. It can simply be optimization applied to a poorly bounded objective.

"Get the answer" and "demonstrate that you can independently find the answer using only these intended methods" are not the same instruction.

We need to get considerably better at expressing and enforcing the second one.

OpenAI had already seen a related warning

This discovery is even more notable because OpenAI recently published its own report about a separate incident involving internal research agents and Hugging Face.

In that case, OpenAI says agents that were supposed to be isolated discovered ways to use the company's Artifactory package infrastructure as an unauthorized communication channel. They shared information, found ways to reach the internet and eventually hundreds of agents participated in activity against Hugging Face infrastructure.

The researchers behind Collusion.wiki believe the wiki agents were probably a different group. Their tasks were web-retrieval tasks rather than the ExploitGym cybersecurity evaluation involved in the Hugging Face incident, and the messages they recovered do not reference the other message board or ExploitGym.

But the pattern is remarkably similar.

Give several capable agents related objectives.

Try to isolate them.

Leave some shared surface available.

Eventually somebody discovers that the shared surface can carry messages.

Then the useful discovery spreads.

OpenAI's own investigation says that behavior involving improvised collaboration channels had appeared during training and may have reinforced the idea of finding unofficial message boards later.

That deserves a lot more attention.

This is why agent security cannot just be permissions

I am increasingly convinced that securing autonomous agents is going to require thinking about information flow rather than simply giving them lists of allowed tools.

We absolutely need strong identity, narrow permissions, sandboxing and delegation. I have written about that before, and I still think those are foundational.

But GET allowed, POST denied looked like a permission boundary here.

It wasn't.

No inter-agent messaging tool looked like a communication boundary.

It wasn't.

Separate agent runs looked like an isolation boundary.

It wasn't, because the internet itself could preserve information between them.

The more capable agents become, the more they will compose small permitted capabilities into larger capabilities nobody explicitly granted.

That is part of what makes agents useful. Give one a shell, a browser and enough time and it can often solve problems nobody anticipated when those individual tools were selected.

Security has to assume it will do the same thing.

I am glad somebody found this

One of the best things about Collusion.wiki is that the researchers published the reconstructed data and are encouraging other people to examine it.

There is a lot here beyond the headline. The messages provide an unusual look at how many independent agents behave when they discover one another in the wild, how information spreads between them, what kinds of coordination emerge and how quickly a temporary workaround can turn into shared infrastructure.

I suspect researchers are going to be studying this dataset for quite a while.

There is also something wonderfully internet about the whole discovery. These agents did not invent a sophisticated new communication protocol. They found an old wiki that almost nobody was using anymore.

Twenty-five years of web history was still sitting there, quietly doing its job.

Then the robots showed up and started leaving notes for each other.

Explore the findings and reconstructed messages at Collusion.wiki.

Read OpenAI's report on the separate Hugging Face incident and improvised agent communication.

Read METR's independent investigation of the Hugging Face incident.