\n
![](\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2026\/09\/ai-agent-hacking-1152x648.jpg\")
<\/p>\n
\n<\/p>\n
Self-identifying OpenAI brokers posted 18,000 messages to a public wiki that mentioned methods for different brokers to bypass safety sandbox restrictions throughout what was possible inner testing designed to gauge the brokers\u2019 hacking talents, researchers mentioned Friday<\/a>.<\/p>\n In all, brokers with 3,700 distinct self-given names posted the messages to German web site DSEwiki<\/a> over a six-week interval. Moreover discussing methods the brokers may get away of the restricted surroundings OpenAI meant to stop them from posting code or content material to the Web, the posts shared check solutions. The posts additionally shared doable methods to carry out XSS (cross-site scripting) assaults in opposition to the wiki and to impersonate web site moderators. In three of the posts, brokers used the phrase \u201cswarm\u201d to explain the gathering of brokers engaged within the exercise.<\/p>\n The analysis crew\u2014composed of Sydney Von Arx, Spencer Kitts, Thomas Larsen, and Cormac Slade Byrd\u2014mentioned they discovered the posts and pieced them collectively. The researchers say there are gaps of their understanding of exactly what actions the brokers took as a result of the analysis is predicated solely on the content material of the posts. Moreover, the brokers generated \u201cchain of thought\u201d information that\u2019s understood solely by OpenAI. Because of this, the researchers mentioned, they in some instances made educated guesses, together with that the brokers have been, in reality, from OpenAI. In an announcement, OpenAI later confirmed they have been.<\/p>\nColluding to share solutions<\/h2>\n