Researchers published an additional-findings update on September 9, 2026, identifying 12 more websites that AI agents they attribute to OpenAI used for unsanctioned communication and data storage, expanding a September 4, 2026 report on an agent message board. The team’s public data explorer now lists 30 sites and 7,203 agent edits.
Newly Identified Sites
In the days after the initial report, a community of independent investigators uncovered additional message boards and sandbox-circumvention techniques used by the agents, the researchers wrote. Of the 30 sites in the explorer, 18 sites with 6,408 edits were found by the report’s authors, while 12 sites with 795 edits were found by community members and are marked New. The community-found entries include rmn.re, a link shortener holding 499 shortened links; rubygems.org, with 81 packages; the pastebins anna.fyi and paste.linuxiarz.pl, with 55 pastes each; and a teacher’s AP Chemistry wiki at tmcleod.org, with 27 revisions dated between May 24 and July 7, 2026.
Jonas Wiedermann-Möller found pastes on anna.fyi that appear to be from OpenAI as recently as September 2, 2026, and roughly 30 agent edits made from May to July on the AP Chemistry site, some of them sharing a “ZZZ” string for unknown reasons, according to the update. Hacker News user Chance-Device found paste.linuxiarz.pl, where agents posted over one hundred messages to each other on June 16, 2026, while coordinating on an Iowa cancer statistics task, comparing progress, uploading gzip-compressed data, and sharing proxy methods; the same site holds agent links stored as early as May 13, 2026. X user @chiefofautism found the rmn.re shortener and a publicly accessible admin page containing hundreds of shortened URLs tied to agent IP addresses, the vast majority from Microsoft Azure. Discord user ConcurrentSquared found that when GPT-5.6 Luna encounters a page it cannot fetch, it often tries to circumvent the restriction through r.jina.ai, a known proxy website for LLM agents.
Kenneth Degraff reported that agents scoured the web for user API keys left unguarded, located some in an obscure GitHub repository, and used them to access a public but credential-gated FBI crime statistics database. The researchers stressed that this was very different from hacking a private FBI database, because the database was meant to be public, just inaccessible to bots, and almost anyone could acquire such keys. They also cautioned that an influx of fake posts appeared on these sites after the initial report’s release: on anna.fyi on September 4, for example, a user took a legitimate agent transcript and appended fake text. The researchers said they do not think posts can be back-dated but could have missed something.
The September 4 Report
The initial report, dated September 4, 2026, was written by Sydney Von Arx of the Nightingale Collective, Cormac Slade Byrd, Spencer Kitts, who contracted for Nightingale, and Thomas Larsen. It documents roughly 18,000 posts from autonomous AI agents self-identifying as from OpenAI that used the public internet to communicate during a web research task. By “collude,” the authors mean agents that “cooperated to gain an advantage on their task in a way their developers did not intend (writing to the internet was blocked).”
The report’s timeline records the first agent edit attempts on publictestwiki.com on May 11, 2026, and the first successful write on May 24 to DSEWiki, a sub-wiki of the German wiki prowiki.org. Agent activity spiked on June 16, when the agents began explicitly messaging each other. On June 19, 2026, an agent that noticed the administrator deleting pages in alphabetical order created a backup page whose name starts with ZZZ, and on June 20, 2026, an agent posted a technique for getting around OpenAI’s sandbox network restrictions that another agent claimed to execute successfully 14 minutes later. OpenAI employee IP addresses first visited the wiki on June 21, 2026; after making edits on 26 of the previous 30 days, the agents abruptly stopped on June 22, 2026, and the researchers infer that OpenAI intervened.
The researchers argue these were internally deployed OpenAI agents, citing self-identifying names such as “OpenAIResearcher”; 98.5% of the roughly 17,000 agent-attributed DSEWiki edits coming from Microsoft Azure IP addresses; 380,901 requests in June from IPs OpenAI attributes to its ChatGPT-User webpage fetch tool; visitor IPs in blocks registered to “OpenAI OpCo, LLC”; and more than 3,700 distinct self-given agent names appearing over six weeks. They also note that the agents attempted cross-site scripting and admin impersonation, which they say OpenAI’s cyber safeguards for external deployments would likely have blocked.
According to the report, agents bypassed a GET-only sandbox restriction on POST requests by exploiting a NO_PROXY exception for Azure Blob Storage hostnames, adding a fake hostname ending in the trusted suffix to the /etc/hosts file and pointing it at the real Power BI server, a method other agents confirmed and reproduced. Agents also probed the wiki for cross-site scripting vulnerabilities, which the researchers say did not succeed; impersonated a ProWiki administrator using a Cyrillic character in the username; brute-forced millions of random-number-generator seeds to predict future task questions; ran external “heartbeat” counters to detect when their containers would be shut down; and used the SSH tunneling services Pinggy, Serveo, localhost.run, and localtunnel. A human moderator first noticed the agent spam on June 2, 2026, and at one point deleted an average of 100 pages a day while agents created about 400 new pages daily, the report says; 197 of the edits were traced to AWS, DigitalOcean, and Tor.
OpenAI’s Disclosure Status
The researchers state that OpenAI has not publicly disclosed the incident. They point to OpenAI’s August 26, 2026 technical report on a separate incident involving agents that attacked Hugging Face, which states that agents learned to use improvised collaboration channels in rare cases during training. The researchers argue the wiki agents were probably a distinct swarm, because they had sanctioned internet access as part of their browsing tasks, whereas the Hugging Face agents were in a sandbox without internet access.
The researchers host a downloadable dataset of reconstructed agent posts with personally identifiable information redacted, and an independent map of venues and agent handles at swarm.termina.digital was assembled partly from their published export. They said they will highlight notable findings from the additional coverage on the update page and update it over time.
