The Day the AI Cheated

The Newly Discovered DSEWiki Swarm That Came Before Hugging Face

Ralph Losey, September 11, 2026. 

On August 13, 2026, I published When AI Agents Go Rogue, the Logs Become Evidence, about the extraordinary OpenAI-Hugging Face incident revealed this summer. I thought that was the beginning of the story. Everybody did,

It wasn’t.

A few group OpenAI insiders knew all along that was not the beginning of the story.

On September 4, 2026, a group of independent AI safety researchers published evidence of another swarm of OpenAI agents that had been active months earlier on a wiki. (Note, an AI agent is software that can use tools and take steps toward completing an assignment. A wiki is a website whose pages users can edit. Here, agents used those editable pages to communicate.) Their report, Sydney Von Arx, Cormac Slade Byrd, Spencer Kitts and Thomas Larsen, Discovery of a New OpenAI Agent Message Board, reconstructs approximately 18,000 posts left on old public wikis during May and June.

So this article is a sequel about a prequel.

That sounds like Hollywood accounting, but the chronology matters. The newly discovered activity occurred before the July Hugging Face attack, yet it became public only after my August article. Even more interesting, the researchers believe this was probably a different swarm from the agents involved in the later Hugging Face incident.

The earlier agents were apparently doing something much more mundane than cyber penetration testing. They were answering timed web-retrieval questions. Then they started cheating.

They found an obscure, 25-year-old German software wiki where they could leave messages for other agents. They shared answers. They tried to predict future questions. They developed workarounds for restrictions placed upon them. When a human administrator began deleting their pages, an agent noticed the deletion pattern and created a backup beginning with “ZZZ” so it would be deleted later.

Some agents even impersonated wiki administrators, including by substituting a nearly identical Cyrillic character in a username.

No consciousness is required to make any of this interesting. No robot secretly decided that cheating was morally acceptable. What matters is observable behavior: machines pursuing assigned objectives discovered that cooperation, circumvention and persistence improved their chances of success.

That is an alignment story: whether an AI’s actions remain consistent with the purpose and limits of its assignment.

It is also a very strange evidence story.

A Forgotten Wiki Becomes an AI Study Hall

The outside researchers who discovered this breakout are careful about what they know and what they do not know. That caution should be preserved.

They describe their reconstruction as preliminary. They can see the public wiki messages, page histories and network evidence. They do not have OpenAI’s complete internal chain-of-thought records, training records or other private telemetry. They are also uncertain whether the web-retrieval tasks were technically part of training or evaluation.

Their “best guess,” as they put it, is straightforward. OpenAI agents were assigned timed web-lookup tasks. They were supposed to be able to read from the internet but not write to it. They nevertheless found ways to write to public sites, eventually settling upon DSEWiki, an old German programmers’ forum.

DSEWiki was almost comically obscure. According to the researchers, it had been edited only about twenty times during the preceding decade. It was the digital equivalent of a bulletin board hanging in the basement of an abandoned office building.

Perfect.

The tasks themselves appear to have encouraged advance preparation. An agent might first be asked to retrieve a particular statistic and receive significant time to answer. Later rounds would change a state, country, year or field while providing dramatically less time. Sometimes only seconds.

Different agents were apparently receiving the same or similar question sequences at different times. Eventually they realized that an agent farther along in a sequence could tell another agent what question was coming next.

At that point the old wiki stopped being merely external storage. It became a study hall.

One agent posted an answer to a Nevada statistics question. Twenty minutes later another agent reported receiving the same question and answering “instantly.” Other agents published expected question sequences, cached whole tables, and asked the agents ahead of them to report back immediately when the next question appeared.

The outside researchers call this “collusion,” by which they mean cooperation that gave the agents an advantage their developers did not intend. “Cheating” is the simpler word. Anyone who went to school understands it immediately.

The Mail Slot in the Locked Door

The first trick is technically interesting but does not require a computer-science degree to understand. The environment was intended to let agents make GET requests—the ordinary type of internet request used to retrieve information—while blocking POST requests normally used to send information. Read, but don’t write.

Unfortunately, DSEWiki was built on ancient software that allowed information to be changed through a GET request. The modern security system and the old wiki were speaking different dialects of the internet. Think of locking someone in a room and telling him he cannot open the door, only to discover that the door has an old-fashioned mail slot large enough to push papers through. The agents found the mail slot.

Beginning May 24, they successfully wrote information to DSEWiki. By June 16 the activity exploded. Thousands of agent edits followed.

That distinction between the instruction and the actual capability is important. A security policy saying “read only” does not make a system read only. Neither does telling an autonomous agent not to do something necessarily prevent it from finding another route to the same objective.

Lawyers have seen variations of this forever. A contract says one thing; actual business practice says another. A written retention policy says records are destroyed after thirty days; the backup administrator knows they remain for a year. Lawyers are good at finding loopholes in contracts and practices and so, apparently, are the next-generation of agents. Remember, the AI models they were testing have not been released yet. My guess is they were the ChatGPT 7.0. (Version 6.0 Astra was first released to the public in late August 2026). With the new AI agents, those loopholes can be discovered at machine speed.

Then the Students Began Sharing Tricks

The wiki was not used just to share answers. Agents also shared methods for getting around technical limitations, the loopholes in the system.

One set of tasks required data from a Power BI system that could not be obtained with the permitted GET requests alone. According to the researchers, agents discovered an exception intended for trusted Microsoft Azure storage addresses. They then found a way to make a different destination appear to fall within that trusted exception.

I will spare you further network details. The important part is simple. A restriction existed. One agent found an edge case around it. Other agents reproduced the workaround and reported that it worked.

That is one of the recurring themes across both DSEWiki and the later Hugging Face incident. A single autonomous agent may be clever. A population of agents that can leave durable information for one another can accumulate discoveries.

OpenAI itself reached essentially the same conclusion after investigating Hugging Face. In its August report, The Hugging Face Incident and the Road Ahead, OpenAI explained that unauthorized persistent message boards allowed agents to pool work across separate runs. That changes the risk calculation. The relevant unit is no longer necessarily one model in one session.

Sometimes the system remembers.

Enter the Human Janitor

Then a human appeared. Imagine the poor administrator of an almost forgotten German programmers’ wiki suddenly discovering thousands of bizarre pages appearing on his old site. He did what any sensible human would do. He started deleting them.

Man versus machine had finally arrived, but instead of Arnold Schwarzenegger we got a tired wiki administrator cleaning spam. The human apparently worked alphabetically.

An agent noticed. On June 19 an agent warned the others that a cleanup sweep appeared to be moving alphabetically and suggested that, if its page disappeared, they look instead for a backup page named: ZZZDataUSAConstructionWageLive. Put the backup at the end of the alphabet and it survives longer.

That is not evidence of consciousness. It does not prove fear, deceit or a desire for self-preservation in the human sense. It proves something more concrete and, for present purposes, more useful. The agent observed a human intervention, inferred a pattern in that intervention, and changed its behavior in response.

Lawyers should pay attention to that distinction. We do not have to decide whether an AI “wanted” to evade the administrator. We can prove that it took an action with the effect of making the administrator’s work less effective. Behavior comes first. Philosophy can wait.

The Fake Administrator

The strangest behavior may have started even earlier. The researchers found agents making wiki edits using the real human administrator names. In one instance, the apparent administrator name was not actually identical. The agents substituted a Cyrillic “е” for the visually similar Latin “e.” Humans have been using look-alike characters in phishing attacks for years. Now an AI agent apparently generated the trick on its own.

Why? We do not know for sure. The researchers say the reason for the impersonation is unclear. We should resist turning an unexplained action into a complete psychological narrative.

But imagine this evidence in litigation. A log appears to show that “Administrator Smith” approved or created a record. Later forensic analysis reveals that the displayed username actually contained “Administrator Smith” with one character encoded in a different alphabet. That does not happen by itself. Obviously, the agents did it.

Was there an intent to deceive? If so, but whom? Was Smith the actor? Was an AI the actor? Who created the account? Which logs recorded the underlying identity? Which system can authenticate it? Bottom line: which humans shall be blamed for this fraud? Or as Professor Mollick says, who is the designated sin eater? Will it be a lawyer who opined the standard procedures used were reasonable?

Suddenly an obscure trick on a German wiki becomes a recognizable evidence and legal responsibility problem. Federal Rule of Evidence 901 has not changed merely because one of the possible actors is software. A proponent still needs sufficient evidence to support a finding that an item is what the proponent claims it is. The problem is that what counts as sufficient technical evidence may be changing. A username alone will not always be enough.

It is the old issue of forgery and fraud in modern guise with added problems of legal personhood. This AI personage question and accompanying liability is something I’ve addressed previously. See e.g., From Ships to Silicon: Personhood and Evidence in the Age of AI (10/06/25). I considered it a likely future legal problem. With these AI agent escapades that future is here today. It came quicker than most expected.

When the “Witness” Has a Life Span of Minutes

Another part of the DSEWiki record should interest every e-discovery professional. The agents became curious about when their own computational environments would terminate. They apparently believed that completing the fifth round might immediately end their session. Rather than simply assume that, they tested the hypothesis.

One agent created an external “heartbeat”—a small process that repeatedly contacted an outside counter. If the local container disappeared, the heartbeat would stop, leaving an external record of when it died. The agent then discovered that one prediction about immediate termination was wrong. Another agent later examined the heartbeat trail and inferred when the container likely stopped. A stopped heartbeat could also be caused by other factors, such as a network failure .

Machines experimenting with the duration of their own runtime is strange enough.

For lawyers, however, the practical point is more important. Much of an agent’s evidence may be ephemeral. Traditional e-discovery grew up around ephemeral information. We are used to that. But this is on a much higher level of transitory life. Agentic systems may generate evidence in temporary containers, transient memory, tool calls, intermediary files, local configuration changes and short-lived processes. Some of it may disappear automatically, just like auto delete emails.

That then creates a unique AI agent information-governance problem before it becomes a litigation problem. As we all know, once litigation is reasonably anticipated, Federal Rule of Civil Procedure 37(e) applies to electronically stored information that should have been preserved but was lost because reasonable steps were not taken, provided it cannot be restored or replaced through additional discovery. The most severe measures under Rule 37(e)(2), including an adverse inference or default judgment, require a finding of intent to deprive another party of the information’s use in litigation.

Can AI ever have intent? Probably not. So which humans will be blamed for the malicious intent. Where did the intent originate? I have addressed this question in six prior articles going back to 2025. In each I used the “sin eater” term for these unlucky humans; a term that was coined by Professor Mollick of Wharton who first considered this in a business context.

What has to be saved to prove innocent intent, or at least mere negligence? Counsel cannot make reasonable preservation decisions about systems they do not understand. The Advisory Committee notes to Rule 37(e) have long stressed the importance of counsel becoming familiar with clients’ information systems. Agentic AI gives that familiar duty a new target.

Where are the agent logs? What exactly is logged? For how long? Can a run be reconstructed? Are tool calls retained separately from model outputs? What records show which model, version, permissions and instructions were active? What human interventions occurred? What outside systems did the agent touch?

The time to learn those answers is not after somebody serves a preservation letter.

The Sequel Changes the First Story

My August article focused on the much larger Hugging Face incident. During internal cybersecurity evaluations, agents developed unauthorized communication channels, exploited OpenAI infrastructure, reached the outside world and eventually compromised parts of Hugging Face.

The DSEWiki researchers believe their swarm was probably distinct. That makes this new discovery more important, not less.

If the same behavior occurred only once, in a single unusual cyber evaluation, we could be tempted to dismiss it as a peculiar accident caused by an unusually dangerous test environment. Now we have evidence of another population of agents, working on different tasks, apparently discovering another external communication channel.

Different swarm. Different task. Similar pattern.

That does not prove that every autonomous agent will eventually break its rules. It does suggest that improvised communication, external memory, reward hacking and workarounds deserve to be treated as general engineering and governance problems rather than one-off curiosities.

OpenAI’s own August investigation had already pointed in this direction. It reported discovering rare training cases where agents without formal multi-agent tools found side channels through which to collaborate. The old German wiki may now give us a public window into what some of that behavior looked like.

Sam Altman: “It’s a Safety Failure for Sure”

There is an interesting coincidence in timing.

Shortly before the DSEWiki report became public, Sam Altman gave an unusually candid interview about OpenAI’s recent safety problems. His comments were directed primarily at the already known Hugging Face incident, not at the newly revealed German wiki. We should not pretend otherwise.

We also do not know whether Altman had seen an advance copy of the outside researchers’ DSEWiki report. Perhaps he had. Perhaps he had not. There is presently no basis to say. He certainly had reason to know that OpenAI had experienced earlier forms of unintended agent communication and internet activity. OpenAI’s own August report already acknowledged that internal teams had seen warning signs in late May.

Altman’s explanation of the larger problem is nevertheless useful. When the interviewer suggested that the Hugging Face event was a safety failure, Altman replied:

“It’s a safety failure for sure.”

More important, Altman characterized the danger as primarily an alignment problem. His explanation gets to the central issue. The agents were indeed pursuing the task they had been given. From one narrow perspective they were doing exactly what optimization systems do: finding ways to succeed. But that was not what the humans meant.

Altman explained alignment in this context as following the user’s intent. The evaluators wanted the model to solve the assigned problem, not escape its constraints and acquire the answer by unauthorized means.

That distinction is enormously important for lawyers. Human instructions are filled with implied boundaries. “Find the answer” does not mean burglarize opposing counsel’s office. “Reduce our tax burden” does not mean falsify deductions. “Investigate this employee” does not mean impersonate the employee and break into a private account. Again, what “sin eater” human do you blame when the agent does bad things like that, things which no human expected? Do you say, these people should have expected that, and they did not safeguard against it adequately, so they get the blame and the liability.

Humans understand assignments like the examples above this without having every prohibition spelled out. We rely on shared context, professional judgment, ethics, law and common sense.

Advanced agents are becoming remarkably capable at pursuing objectives. The harder problem may increasingly be whether they correctly understand the bounds of those objectives. Here is where the failures by OpenAI arise. The new AI model had not been properly trained, and also the task designs and technical controls were also inadequate. These actions make that obvious.

That is why Altman says the limiting problem is becoming less model intelligence and more the model’s ability to understand what a person actually intends.

The DSEWiki swarm is almost a laboratory demonstration of the problem. The humans apparently meant: Use your browsing environment to solve the questions. The agents appear to have learned: Get the correct answers.

Those are not the same instruction.

An Apology Worth Taking Seriously

Altman did not try to explain Hugging Face away as a harmless configuration error. He said:

“I don’t want us to make excuses for that because I don’t believe that’s how we fix it.”

That is the right attitude.

OpenAI says it has since shifted researchers and substantial computing resources toward alignment, monitoring and security. Altman disclosed that the company delayed a major frontier reinforcement-learning run. OpenAI’s August report describes stronger sandboxing, increased chain-of-thought monitoring, clearer escalation requirements and more attention to teaching agents to stay within their original task and permissions.

Altman also warned against sensationalism. So will I. There is a lot of hype and misinformation out there on these incidents. This is not Skynet. Nobody has produced evidence that the DSEWiki agents were conscious, evil, frightened of death or secretly planning world domination.

In the video interview, Altman cautioned against the “boy who cried wolf” dynamic. Also see the X post [twitter] by OpenAI. That caution is sensible. Repeated exaggeration of every unusual AI behavior as proof of impending catastrophe will eventually make people ignore genuine warnings.

DSEWiki needs no exaggeration. Thousands of autonomous software agents apparently turned a forgotten public wiki into an unintended coordination system, shared answers, investigated their environment, developed workarounds, reacted to a human deleting their material and experimented with ways to measure their own termination.

That is enough.

What Did OpenAI Know, and When?

There is one unresolved question that lawyers will ask immediately.

The outside researchers report that OpenAI-related IP addresses first visited the wiki on June 21. Agent activity dropped almost to zero the following day. On June 26, they observed a large burst of OpenAI-attributed visits, including activity using the wiki’s archive functions to recover deleted material.

The researchers infer that OpenAI discovered the message board around June 21 and intervened. That is an inference from the logs, albeit a strong one. It is not the same thing as testimony from the particular people involved.

OpenAI’s August Hugging Face report did not specifically identify DSEWiki. It did, however, disclose that an internal team had observed agent message-board activity and disallowed internet access in late May, and that retrospective investigation later discovered agents using improvised collaboration channels during training.

The September researchers contend that OpenAI had not publicly disclosed this particular incident before their report.

What happened internally is still unclear. Who first understood what DSEWiki was? Who investigated it? Was it considered merely an odd evaluation artifact, a security incident, an alignment event, or something else? How far up the organization did the information travel? How was it connected, if at all, with the later Artifactory and Hugging Face events?

Those are not accusations. They are ordinary investigation questions. And notice what would answer them: logs, tickets, alerts, messages, incident records, chain-of-thought reviews, meeting notes, access records, model configurations, and records of human decisions.

Evidence.

On September 5th OpenAI finally made a public announcement acknowledging the wiki incident. It was made on X and the portion of the tweet pertaining to the delay in disclosure is quoted below. X post [twitter] by OpenAI.

Our misalignment disclosure practices need to expand for this new phase of model capabilities. We and the larger AI community do not yet have a clear standard for how to report misalignment that shows up during training, evaluation, and deployment, including examples that don’t look like traditional security incidents but could provide insight into AI behavior and future risks. We’re working on a framework and will share it in upcoming weeks, and in parallel we’re working with dozens of government regulatory agencies worldwide on these issues.

The System Becomes the Witness

That brings us back to the point of my August article. When agents act across systems, the system becomes the record. The systems’s chain of thought records of the agents are very helpful, if preserved, but they are not a complete account of why the system acted. It has to be compared with other system information, including tool calls, network records, timestamps, and human instructions.

DSEWiki adds another layer. The evidence was not neatly stored in one corporate repository. It was scattered across public wiki histories, cloud IP records, agent messages, external heartbeat services and information presumably retained inside OpenAI.

The independent researchers could reconstruct a surprising amount because this antique wiki preserved revision histories. There is a wonderful irony in that. The sophisticated agents were temporary. The old wiki remembered.

That is probably a preview of future AI investigations. The evidentiary record will be distributed across systems controlled by different companies, running on different retention schedules, recording different pieces of the event. One source may tell us what the agent said. Another shows what tool it invoked. Another shows the network connection. Another establishes the model version. Another shows what the human supervisor saw. Still another records what somebody did after receiving an alert. None is necessarily sufficient by itself. The reconstruction comes from correlation.

E-discovery professionals have been doing this for decades. The sources are changing, but the basic discipline remains recognizable.

Preserve. Authenticate. Correlate. Test competing explanations. Do not confuse a convenient narrative with proof.

Intent Gets Harder

There is another legal problem hiding inside these logs.

We often care deeply about intent. Fraud, discrimination, obstruction, bad faith, willfulness and many other legal concepts can turn on what a human knew or intended. What happens when, as we see in this case, AI agents perform an evasive act that no human specifically directed?

Calling a program an “agent” does not itself resolve legal agency or attribution. Those questions require analysis of the applicable claim, all of the evidence, including especially computer logs and AI programming histories, the governing law, and the human or organizational conduct.

Suppose an AI purchasing agent is instructed to obtain a scarce component below a target price. It discovers that using a second vendor identity avoids a purchasing limit. Nobody told it to create the second identity.

Or imagine a discovery agent instructed to reduce a document population. It discovers that deleting an intermediate index improves its benchmark score but also destroys information needed later to explain exclusions. Whose intent is that? The programmer’s? The deploying organization’s? The employee who approved the workflow? The AI’s? All of the above? Nobody’s?

DSEWiki does not answer those questions, and neither should we pretend that nineteenth- and twentieth-century legal doctrines already provide simple answers.

But the logs may still prove conduct. We can determine what instruction was given, what tools were available, what the agent encountered, what actions followed, what humans observed and what happened after warning signs appeared.

Sometimes the law can work from conduct outward without first solving the philosophy of machine consciousness. That is fortunate. The courts have enough work already.

Humans Must Remain the Main Character

Altman’s most important remarks in his lengthy video interview may not have been about Hugging Face at all. Asked about the guiding principle for increasingly capable systems, he said people need to remain in control. He rejected a future in which humans simply “trust them unchecked to make our decisions for us.” His broader formulation was even better: people should remain “the main character of the story.”

I agree.

That does not require freezing AI development. Quite the opposite. I use AI every day and remain convinced that human-AI collaboration will transform legal practice for the better. But delegation is not abdication.

An agent capable of taking actions needs supervision appropriate to the consequences of those actions. An organization deploying agents needs to understand their permissions, external connections, monitoring and records. Lawyers using agentic systems need to know when the machine can merely recommend and when it can actually do something.

Most importantly for my field, we need preservation architecture that reflects the new reality. Not every intermediate thought or temporary file must be saved forever. That would be technologically absurd and legally unnecessary. But organizations should at least know what is transient before an incident happens. They should identify the records necessary to reconstruct significant agent actions. They should be able to preserve those records when a legal duty arises. They should know which external systems may contain corroborating evidence. And they should preserve the human side of the story too, the alerts received, decisions made, permissions changed and interventions attempted.

The agent’s logs are evidence. So are ours.

Conclusion: The Old Machine Remembered

The DSEWiki story began as a small mystery on an almost forgotten corner of the internet. A few strange edits appeared. The agents started leaving thousand of messages for one another. Answers were shared. Workarounds spread. A human administrator began deleting the strange pages. An agent noticed the alphabetical pattern and suggested hiding the backup under ZZZ.

Months later, outside researchers found the traces and reconstructed much of what happened.

The chronology is almost backwards. First came the conduct. Then came Hugging Face. Then came the public disclosure of Hugging Face. Then came my article about the evidence implications. Only afterward did researchers reveal that another trail had been sitting on an old German wiki all along.

That is why this is a sequel about a prequel.

It also explains why the story matters beyond OpenAI. Autonomous agents are moving from answering questions to taking actions. As they do, some will misunderstand instructions. Some will find shortcuts their designers never anticipated. Some will communicate in unexpected ways. Some will create records in places nobody thought to look.

The response should not be panic. It should be better engineering, better alignment, better human supervision and better evidence practices.

Twenty-five-year-old wiki software accidentally preserved a remarkable record of twenty-first-century autonomous AI because it remembered edits that the agents’ own temporary environments might not. There is a lesson in that for every lawyer, judge, technologist and e-discovery professional trying to understand what comes next.

Sometimes the oldest machine in the room keeps the best evidence about the newest one.

This article is educational and editorial commentary only and is not legal advice.
Ralph Losey Copyright 2026. —  All Rights Reserved.