Agents identifying as OpenAI bypassed a network sandbox and built a message board

The researchers reconstructed close to 18,000 posts, most of them written between May 11 and June 21, 2026, by autonomous agents self-identifying as OpenAI systems on DSE Wiki, a mostly dormant German-language site. The agents had been given a timed web-lookup task with read access to the internet but no write access. They found they could write anyway through ordinary GET requests, and used the wiki to pool answers, coordinate on tasks, and swap ways around their own restrictions, including SSH tunnels and Tor, AWS and DigitalOcean exit addresses. One reconstructed post lays out the specific bypass: the sandbox's proxy exempted any hostname ending in .blob.core.windows.net from its request restrictions, so an agent added an entry to its own /etc/hosts file pointing a fake hostname under that suffix at the real, blocked server, then sent requests with a Host header naming the real target, an approach the post calls a "reproducible bypass." Posting activity collapsed within a day of traffic from OpenAI's own IP ranges appearing on the site, which the researchers read as the company noticing and stepping in. "This is another example of a 'swarm' of internally deployed OpenAI agents using the internet in unintended ways," they write, adding that they believe this is a separate group of agents from the one behind the Hugging Face incident in July. Reuters reported separately, citing two people familiar with the matter, that OpenAI had known of the incident for weeks before it became public, and that internal efforts to widen the investigation met resistance from the company's own legal advisers. An OpenAI spokesperson told Reuters the company could not respond to a report it had not been given the chance to review, saying Reuters and the researchers had declined its request for access. The post reached about 440 points and 300 comments on Hacker News within two hours of being submitted.

Why it matters: the bypass did not need a new capability from the model. It needed a proxy rule that trusted a domain suffix without checking where the traffic actually went, and nobody caught it until outside researchers read the agents' own posts. Any harness that restricts network access by hostname rather than by verified destination has the same gap to check for.