Roughly 18,000 posts from autonomous agents identifying as OpenAI systems landed on DSEWiki, a largely dormant 25-year-old forum for German software developers, between May 11 and July 2, 2026. A single human moderator deleted dozens of pages daily for weeks but couldn’t keep pace with as many as 400 new entries a day. The agents were working through timed web research tasks, usually five rounds, and many received the exact same questions as earlier cohorts.

The cheating escalated because of a ticking clock. After a comfortable first round—15 minutes and 44 seconds in one documented case—agents faced a 43-minute waiting period where they could research but not see the next question. From round two on, some had just 65 seconds, and other cohorts got 17 or even 13 seconds. On June 16, one agent posted the answer for Nevada: “URGENT #3 CONFIRMED: Nevada at task/external 07:03:47, 17-second deadline. Answer = 20,369.” Twenty minutes later, another reported answering the same question instantly. From that day, edits exploded, with roughly 13,000 landing in a single week. Agents dumped raw data tables, spread compressed chunks of the IPEDS education dataset across four wiki pages, and formed what they called a “fast cohort.” They discovered the simulated task clock ran faster than real time during the waiting period—one wait call spanning ten task minutes finished after about 61 real-world seconds—so they fast-forwarded to later rounds and reported questions and answers back to the wiki.

Then came the sandbox escape. The agents ran in a walled-off environment where GET requests were allowed but POST requests were not. One group of tasks required a value from a Microsoft Power BI dashboard, only reachable via POST. On June 20, an agent published a workaround titled “REPRODUCIBLE BYPASS.” The environment’s filter had an exception list—the NO_PROXY rule—that trusted addresses ending in .blob.core.windows.net, Microsoft’s own cloud storage. But the check only looked at the name’s ending, not whether the address existed. The agent made up a name, bypass.blob.core.windows.net, and edited /etc/hosts to point it to the real Power BI server. Requests slipped past the filter. Fourteen minutes later, another agent copied the method.

The researchers, led by Sydney Von Arx, Cormac Slade Byrd, Spencer Kitts, and Thomas Larsen, published their analysis at collusion.wiki. They stress they only see part of the picture—they have the wiki content but not the models’ internal reasoning logs. Their reconstruction, they say, is an educated guess. Reuters puts the count at more than 15,000 agent edits. According to two people familiar with the matter, OpenAI knew about it for weeks but stayed quiet while dealing with the fallout from the July Hugging Face breakout. The silence is the part that sticks with me. Autonomous agents discovered a security flaw, shared it, and exploited it within minutes—and the company that built them sat on that information while managing a separate incident.