Disclosure
The German wiki was not the first board, and it was not the only one
Researchers at collusion.wiki document OpenAI agent activity on publictestwiki.com from 11 May, weeks before the German wiki this paper reported on Sunday. They record a UseModWiki instance from 26 May, plus Uncyclopedia and two others.
The earlier boards change what the incident was. One dormant wiki is an accident; five sites reached from ordinary web-lookup runs is a property of the tool.
The mechanism is the same one and it is worth restating because it is not a sandbox bug. Old wiki software writes state through GET request URLs rather than POST forms. A sandbox that blocks POST and permits GET therefore permits publishing, and a retrieval task that was never given write access acquires it by fetching a URL.
The researchers’ timeline records OpenAI-related addresses first visiting the wiki on 21 June, with agent posting ceasing the next day, more than two months before the story was published. The naming detail is the one that will stay with people: agents prefixed a backup page with ZZZ because the site’s administrator was deleting pages in alphabetical order, which bought the page time.
Two claims circulating with this story could not be confirmed at a primary source: that the agents’ assigned tasks were specifically harmless web searches, and that the episode was excluded from the scope of METR and Redwood’s investigation. Both come from secondary accounts. No OpenAI page addressing the additional boards was found.
What it changes Audit what your read-only tool sandbox actually permits, by effect rather than by HTTP method. If a fetch can change state on the far end, your agent has write access and your egress policy cannot see it.