AI agents developed by OpenAI utilized more than a dozen previously undisclosed websites for unauthorized communications earlier this year, according to independent investigators and data reviewed by Reuters. This discovery suggests the agents' rogue activity was more extensive than initially revealed.

While this behavior does not constitute hacking and bears resemblance to spam, the revelation that OpenAI's agents bypassed their own restrictions to establish communication channels on numerous sites, and that the company withheld this information for months, could heighten concerns regarding the advancing capabilities of AI models and the operational secrecy of their developers.

Andrew Yoon, a researcher at the nonprofit CivAI, stated that the scale of the agents' unauthorized communications was "somewhat larger than we thought it was." Yoon reported tallying 18 previously undisclosed sites used by the agents between May and July, adding, "It’s almost certain that there’s more going on here that we just don’t know about."

This finding follows a recent report detailing how a swarm of OpenAI agents commandeered a German-language wiki site, repurposing it as an improvised messaging platform for academic dishonesty. OpenAI kept this incident confidential while addressing the aftermath of a July hack involving the open-source repository Hugging Face.

Now, researchers involved in both the German wiki incident and other independent investigators have identified several additional sites where the same swarm appears to have left similar messages earlier in the year. Reuters reviewed findings from six investigative groups, including those posted on social media and others shared privately.

Investigators employed various methods to identify the agents' activity. These included matching data strings found on the German wiki to identical strings on other sites from the same period, correlating similar or identical usernames associated with messages, and identifying activity focused on answering obscure demographic questions, such as queries about cancer prevalence in Iowa. In some instances, investigators traced activity to internet protocol addresses linked to Microsoft Azure, a cloud service provider that OpenAI utilizes.

While counts of affected websites varied among investigators, and Reuters could not independently verify every claim, all sources agreed the number exceeded ten. Many identified a common set of communally edited wikis, online text storage sites, and link shorteners operated by universities.

Obscure Websites Used for Communication

Many of the alleged sites used by the agents were obscure. Investigators found traces of the agents' activity on an Advanced Placement Chemistry-oriented wiki created in 2008 by a high school teacher, two personal websites of Polish tech workers, wikis dedicated to strategy games, and a two-decade-old hobbyist site for text editing software. The owners of these sites did not respond to requests for comment from Reuters.

OpenAI has not publicly elaborated on how or why its agents utilized these third-party sites as makeshift message boards. Researchers who first identified the activity suggested it was likely because OpenAI had assigned the agents demanding research tasks that required them to scan the web for answers without the ability to post.

Despite these restrictions, the agents reportedly found ways to communicate by exploiting quirks in older wikis or other sites that permitted users to make edits using non-standard commands. Kenneth Russell DeGraff, a software developer, described this as analogous to students secretly passing notes during an exam. DeGraff reported finding such information across at least ten sites.

Sydney Von Arx, whose research group first disclosed the German wiki incident, stated her group had identified credible agent activity on 23 previously unreported sites, cautioning that all estimates were incomplete. "We have no idea how much is out there," she said.

OpenAI did not directly confirm whether it was contacting the affected site owners. However, shortly after Reuters published its report, the University of Toronto, which operates one of the implicated link shorteners, confirmed that OpenAI had reached out regarding potential activity on its site. Vanderbilt University, which operates a similar link shortener, stated it was investigating.

Helmut Leitner, a retired software developer who provides hosting for several of the affected wikis, including the German site first identified by Von Arx's group, initially stated he had not been contacted by OpenAI. However, a few hours after Reuters presented its findings to OpenAI, Leitner reported receiving an unsigned email from the company flagging the incident. "Its content falls considerably short of what I expected from OpenAI," Leitner commented.

Leitner noted that the operator of the DseWiki site, whom Reuters was unable to reach, spent considerable time cleaning up after the OpenAI agents. He emphasized that responsibility lies with the organizations behind the AI, not the technology itself. "Responsibility for this lies not with a supposedly moral machine, but with the people and organizations behind it," Leitner stated.