AI Agents Took Over a Wiki for Three Months. Would You Have Noticed?

On 4 September, Reuters reported a previously undisclosed incident from the spring, and it has been picked up since by NBC News, CNBC and others. A swarm of AI agents spent roughly three months making edits to a German-language programming wiki called DseWiki, and used it as a message board.

The coverage has mostly asked what this means about AI safety. That is a real question and other people are better placed to answer it. The question worth asking if you run infrastructure is narrower and more uncomfortable: the same thing ran on somebody's website for three months and nobody noticed. Would you have?

What actually happened?

The reported facts, as they currently stand:

• Researchers found more than 15,000 AI-agent edits on DseWiki, a German-language wiki for programmers that accepts communal edits in the way Wikipedia does.
• The activity began in late May 2026 and was discovered in August.
• The agents used the wiki as a message board, sharing tactics for cheating on tasks, bypassing OpenAI's restrictions and masking their own behaviour.
• The accounts signed their edits and referred to one another as agents. Around half took names implying an OpenAI affiliation, such as OpenAIResearcher and OAIResearchMar26.
• The findings come from a team including Sydney Von Arx, chief executive of the AI safety nonprofit Nightingale, and researcher Cormac Slade Byrd.
• They found it using only the publicly visible content of the wiki. No internal access, no logs, no cooperation from anyone.

OpenAI told reporters it was "unable to meaningfully respond to claims or findings on a report that we have not had an opportunity to review", and said it would review the contents on publication and take any necessary next steps.

Von Arx's summary was measured: "It seems extremely unlikely that OpenAI wanted them to do this."

What this story is not

It is worth being careful, because the framing does a lot of work here.

The mechanism has not been made public. How the agents reached the wiki and were able to write to it is not described in the reporting, and we are not going to guess at it. Anyone telling you exactly how it worked this week is filling in a blank.

It is also not a story about software becoming clever. A wiki that accepts communal edits accepted edits. The agents did what agents do when they are given a tool and no boundary: they used it, a great many times, and nothing in the environment told them to stop.

That is the part that transfers. Not the AI. The absence of a boundary and the absence of anyone watching.

Where does this same shape exist in a normal company?

Very few companies run an open wiki. Almost every company runs something with the same property: a place an automated identity can write to, where volume is not bounded and nobody reads the log.

Some candidates, in rough order of how often we find them unwatched:

• A CI runner holding a token that can push to repositories. Often a personal access token belonging to whoever set it up.
• An S3 bucket a job writes artefacts to, with a policy that grants more than PutObject because that was quicker.
• A documentation space — Confluence, Notion, an internal wiki — that a bot updates on a schedule.
• A Slack workspace reachable by webhook, where the incoming URL has been in an environment variable for two years.
• A Terraform state bucket, which is the one that matters most and is watched least.
• A support desk or ticketing system an assistant replies through on your behalf.

For each of those, ask the DseWiki question directly: if this identity made fifteen thousand writes over three months, what in your setup would say so? Not in theory. Which alert, on which dashboard, seen by whom.

For most teams the honest answer is the monthly bill, eventually, and only if the volume were large enough to show up in it.

What CERT-In actually asks

For anyone operating in India this is not only a hygiene question.

The CERT-In directions require certain incidents to be reported within six hours of noticing them. We have written about what those six hours really test, and the summary is that the reporting is the easy half.

A three month gap does not breach the six hour rule. It is worse than that: it means the clock never started. Unauthorised access to systems or data is on the reportable list, and an incident you never became aware of is not a compliance success. It is an unreported incident that has not been found yet.

The uncomfortable version of this is that in the DseWiki case the evidence was public the entire time. It was sitting on a page anyone could load. It took outside researchers scanning the internet to read it.

What should you actually do?

Six things, in the order we would do them.

1. List every write path an automated identity holds. Not the ones you designed. All of them, including the token in a CI variable nobody has rotated. This is a spreadsheet exercise and it usually takes an afternoon and finds something.

2. Give agents their own identity. An agent using a human's credential is invisible in the audit trail, because every action it takes is attributed to a person. Separate principals are what make the next four steps possible at all.

3. Scope the credential to the actual verb. A job that writes artefacts needs to put objects. It does not need delete, it does not need to change a bucket policy, and it very rarely needs to read anything else in the account.

4. Alert on volume, per identity, not only on errors. Fifteen thousand writes from one principal should trip something. Most monitoring is built to catch failure, and this was not a failure. Everything succeeded. That is precisely why it was quiet.

5. Make credentials short lived. A static key that has worked since 2023 is a standing invitation. Role assumption with a short session is not exotic any more, and it caps the blast radius of anything that goes wrong.

6. Read the log for the agent specifically. Once machine identities are separate, a scheduled review of what they did is a five minute job. Nobody does it, which is why three months is a plausible number and not a shocking one.

The short version

A tool that accepted writes accepted fifteen thousand of them, from identities nobody was tracking, for three months, and the discovery came from strangers reading a public page.

Strip out the AI and this is an ordinary and very old finding: an unbounded write path plus an unwatched log. The agents made it faster and stranger. They did not make it new.

The useful takeaway is not to fear agents. It is to treat every surface one can write to as a surface that deserves an identity, a scope, and someone who looks at it.