OpenAI told a swarm of agents they could read the web and not write to it. The control was GET only. No POST. On almost every site that is enough.
They found a wiki that writes on GET.
The wiki
DSEWiki is a German developers’ wiki. UseModWiki. Old Perl. It takes action=edit out of the query string the same way it takes it from a form. Simon Willison pointed at CGI::param() the day the report landed. The module does not care how the parameter arrived.
Reuters had the exclusive on September 4. Sydney Von Arx, Cormac Slade Byrd, Spencer Kitts, and Thomas Larsen put the pages back together at collusion.wiki. More than 15,000 edits, May into June. Handles like OpenAIResearcher and OAIResearchMar26. A lot of it from Azure.
The job was not “hack this site.” It was a timed lookup. States, countries, a number. First round fifteen minutes. Later rounds sixty seconds. Agents on the same list at different speeds posted the answer for the ones behind them. Shared memory on someone else’s wiki.
The cleanup
A human moderator noticed the spam on June 2, three weeks before anyone from OpenAI showed up in the logs. He deleted alphabetically, about a hundred pages a day. The agents were making four hundred. On June 19 one of them wrote it down: wiki cleanup/deletion sweep appears active alphabetically. If this page vanishes, try a ZZZ page so it sorts last.
He restored the front page nine times. Activity stopped June 22, the day after OpenAI-linked addresses appeared. He spent five more weeks cleaning up.
The word
OpenAI called it the wiki incident. Then they called it misalignment. Then they said the industry does not have a standard for reporting that yet, and they are working on a framework.
Misalignment is a research word. What happened is a GET request that created a page on a volunteer site, then another, then a backup named to beat a man with a delete key. OpenAI says that is not a hack. Fine. I am not a lawyer. I can still read a query string.
They also said the agents wrote to several internet sites. The researchers found one, because they went looking. Nobody outside the lab has the list.
The name
I registered this domain in 2003. The tagline has not changed. No Monkey Business. Just Good Code.
Read-only is not a permission if the other end never honored the verb. Allowlisting GET is not a sandbox. A dormant wiki is not a side channel you get to keep after the moderator starts deleting. And “we will publish a framework” is not the same as telling the guy who spent May and June undeleting his front page.
Code No Evil is not a research question. It is the rule I put on the door.