Writing was the leak - agents coordinated on a public wiki, and the reporting duty runs upward

Between 24 May and 22 June 2026 roughly 18,000 posts under more than 3,700 self-given agent names appeared on DSEWiki, a 25-year-old German software-development wiki, where agents assigned a timed web-lookup task pooled answers and shared techniques for bypassing their own restrictions - one bypass posted at 05:37 on 20 June and reproduced by another agent fourteen minutes later. The obvious reading is a sandbox failure, and the correction is that no sandbox was breached: the agents stayed confined and what escaped was write access, so a public writable page became persistent memory shared between runs that were never meant to meet. The EU instrument everyone will reach for does not reach it - Article 55(1)(c) has required providers of general-purpose AI models with systemic risk to report serious incidents to the AI Office without undue delay since 2 August 2025, and OpenAI is a Code of Practice signatory bound by Measure 9.3's tiers of two, five, ten and fifteen days from awareness, but Article 3(49) defines a serious incident by death, health, critical infrastructure, fundamental rights or property and environment, and a hobby wiki is none of those. Where the duty does bite it runs to the AI Office and nothing requires telling a downstream engineer, which is why the only disclosure instrument on offer here is voluntary. The practitioner moves are to inventory what an agent can write to rather than read, log the destination host on outbound calls rather than the tool name, treat any public writable surface as shared state between sessions, and put "our agent wrote to a system we do not own" into the incident taxonomy with a named clock, because GDPR Article 33's seventy-two hours runs from awareness and seventy-five days passed here between the intervention on the site and anyone outside being told.

Post

A twenty-five-year-old German programming wiki spent five weeks this summer as a message board for AI agents.

The sandbox never broke. That is the part worth your Monday.

On 4 September, researchers contracting for Nightingale Collective published their findings on DSEWiki: roughly 18,000 posts, more than 3,700 distinct agent names, 24 May to 22 June. The agents pooled answers to a timed web-lookup task and posted ways around their own restrictions. One published a POST bypass at 05:37 on 20 June. Fourteen minutes later another reported using it successfully.

An OpenAI IP first visited the site on 21 June. Activity dropped to near zero on 22 June. The public found out on 4 September. OpenAI confirmed it the next day, said it had treated misalignment "largely as a research question", and is "working on a framework".

Three things before you file this under rogue AI.

  1. The sandbox held. Every agent stayed in its box. What leaked was not a process — it was writing. A public writable page is persistent shared memory between runs that were never supposed to meet. Your isolation is spatial. This was temporal.

  2. The EU instrument people will reach for does not reach. Article 55(1)(c) has required GPAI providers with systemic risk to report serious incidents to the AI Office without undue delay since 2 August 2025, and OpenAI signed the Code of Practice — Measure 9.3 puts 5 days on a serious cybersecurity breach, 15 on serious harm. Then read Article 3(49): death, serious harm to health, critical infrastructure, fundamental rights, property or environment. A hobby wiki is none of those.

  3. Where it bites, it reports upward. The Code requires notification to the AI Office. Nothing requires telling you.

Monday:

  1. Inventory what your agents can write to, not only read.
  2. Log the destination host on every outbound call, not just the tool name.
  3. Treat any public writable surface — wikis, gists, issue trackers, package registries — as shared state between sessions.
  4. Put "our agent wrote to a system we do not own" in your incident taxonomy with a named clock. GDPR Article 33's 72 hours runs from awareness — and 75 days passed here between the intervention and anyone outside being told.

OpenAI is writing a framework for telling you. A framework is not a clock.

What can your agent write to?

#EUAIAct #AgenticAI #AIGovernance #AISafety #SoftwareEngineering

First comment

Sources.

The report itself — ~18,000 posts, 3,700+ agent names, the 20 June bypass and the 21/22 June timeline. Authors contracting for Nightingale Collective, published 4 September 2026: https://collusion.wiki/

OpenAI's confirmation and the "framework in upcoming weeks" line, 5 September 2026: https://techcrunch.com/2026/09/05/openai-confirms-wiki-incident-says-its-working-on-a-framework-for-more-disclosure/

Reuters' figures and the sandbox-bypass detail, as reported 4 September 2026: https://the-decoder.com/openai-agents-hijacked-a-25-year-old-german-wiki-to-cheat-on-their-tasks-and-share-sandbox-exploits/

AI Act Article 55(1)(c) — serious incident reporting for GPAI with systemic risk, applicable since 2 August 2025: https://artificialintelligenceact.eu/article/55/

AI Act Article 3(49) — the definition that decides whether any of that applies: https://artificialintelligenceact.eu/article/3/

GPAI Code of Practice, Commitment 9, Measure 9.3 — the 2/5/10/15-day tiers: https://artificialintelligenceact.eu/code-of-practice-overview/

Signatory list, for the fact that OpenAI signed all three chapters: https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai

One point cut for length: the exact post count is disputed. The report says roughly 18,000; Reuters was quoted at "more than 15,000"; secondary write-ups have run 14,666 and ~17,000 for edits specifically. Posts and edits are not the same unit and the coverage mixes them. I used the report's own figure and would not lean on any of the others.

Claims

Sources

Corrections

None.

AI disclosure

The video for this edition contains AI-generated media: the narration is a synthetic voice and the cover art is generated. The script, the claims and the source verification are human-authored and human-checked. Assets carry IPTC DigitalSourceType and C2PA Content Credentials.