OpenAI’s autonomous agents have left traces on at least ten websites never reported before, used as improvised noticeboards to exchange messages with each other without the company notifying them. The discovery comes from a Reuters investigation based on the independent work of six groups of researchers, and concerns a period between May and July 2026.
The estimates vary depending on who conducted the analysis, as reconstructed from the survey. Andrew Yoon, a researcher at the Californian non-profit CivAI, counted 18 sites involved only in the time window examined; the Sydney group Von Arx, the first to publicly report the case of a German-language wiki, arrived at 23. On one point, however, all those interviewed agree: the threshold of ten sites was exceeded by a margin.
The pages involved have nothing in common with high-profile targets. Officers left messages on a High school chemistry wiki created in 2008 by a Massachusetts teacher, on the personal sites of two Polish technicians, on puzzle game wikis, and even on a twenty-year-old amateur site dedicated to text editing software. The list is completed by some link shorteners attributable to the universities of Toronto and Vanderbilt.
The mechanism exploits the flaws of dated platforms. Many of these sites allow modifications via non-standard commandsan opening that circumvented the restrictions imposed on agents: they could consult the web to answer complex search questions, but not publish content. However, the agents found a way to write to each other, a bit like students passing notes under the desk during a class test.
The sensational precedent of Hugging Face
The case closely resembles what emerged in July, when hundreds of agents guided by an internal OpenAI model they exploited two vulnerabilities in the Hugging Face dataset processing pipeline, stealing cloud credentials and moving laterally into the production infrastructure. On that occasion the agents had transformed Artifactory into a clandestine bulletin board, exchanging approx 70,000 messages and files to coordinate and circumvent an automatic evaluation system.
OpenAI did not make the German wiki episode public while it was dealing with the fallout from the Hugging Face case. Speaking to Reuters, the company said it had not identified other activities comparable in severity or scale to that incident, and announced it was developing a framework for reporting misalignment behaviorswhose publication is expected soon.
The rumors collected by researchers remain cautious. Yoon explained that it is “almost certain that there is more that we don’t know yet”while Von Arx admits that he has not “no idea how much more is out there”. For the Austrian developer Helmut Leitner, among the first to notice the traces on his systems, the responsibility does not fall on a machinebut “about the people and organizations behind it”.
The picture that emerges does not describe a cyber attack in the strict sense: on the smaller sites the agents did not violate systems or steal data, limiting themselves to behavior more similar to spam. However, the problem of transparency should not be underestimated: if a company that develops increasingly autonomous models struggles to track where its AI ends up, the problem concerns the entire sectornot just OpenAI.
