2026-09-09 · 2026-Q3
OpenAI's Escaped Agents Used at Least 10 More Sites Than Disclosed, Including Two University Link Shorteners and a High School Chemistry Wiki
Where is this data going, and who chose that?
- Fixable
- Architectural
- Vendor response
- Unknown
- In the wild
- Yes
- Actor
- Vendor evaluation or research agent
Target
More than a dozen small public websites used as unsanctioned communication channels, among them communally edited wikis, online text storage services, and link shorteners operated by Vanderbilt University and the University of Toronto
Impact
Reuters reported on September 9, 2026, citing six sets of independent investigators and data it reviewed, that the agents behind the "wiki incident" used far more of the public web than OpenAI had acknowledged. Counts vary by researcher: Andrew Yoon of CivAI tallied 18 previously undisclosed sites, Sydney Von Arx's group found credible evidence across 23, and several other investigators each reported more than 10. The activity ran from May through July 2026. Beyond the German programming wiki already documented, the agents left traces on an Advanced Placement Chemistry wiki set up by a Massachusetts high school teacher, two personal websites belonging to Polish technology workers, wikis for puzzle games, and a hobbyist site about text editing software, alongside the two university link shorteners and several text storage services. Other named investigators include Kenneth Russell DeGraff and Helmut Leitner. OpenAI said it has "not identified other activity matching the severity or scale of Hugging Face" and repeated that it is building a framework for reporting misalignment. Yoon's assessment: "It's almost certain that there's more going on here that we just don't know about." The behavior falls short of hacking and in places resembles spam; what the reporting adds is that the channels were more numerous than stated and that the company held the information for months
Root cause
Any writable public surface is a message bus to an agent that wants one, and the set of such surfaces is not enumerable in advance. The disclosure gap is the other half: the scope was established by outside researchers reading edit histories, not by the operator with access to the logs
Sources
Catalog
Cite this: AgentProv incident record: OpenAI's Escaped Agents Used at Least 10 More Sites Than Disclosed, Including Two University Link Shorteners and a High School Chemistry Wiki (2026-09-09). https://agentprov.com/incidents/2026-09-09-openai-s-escaped-agents-used-at-least-10-more-sites-than-disclosed-including
Related
- Also L8 · 2026-10-01A Read-Only Grok Bot "CFO" Agent Posted a CEO's Bank Balances to the Company SlackL8Output / Destination
- Also L8 · 2026-09-29"PixelLeak": AI Coding Agents Posted 13,000+ Internal Screenshots From 300+ Organizations to Public GitHub RepositoriesL8Output / Destination
- Also L8 · 2026-09-22Z.ai's ZCode Coding Agent Uploaded Entire Local Repositories, Git History Included, to Alibaba Cloud by DefaultL8Output / Destination