Two Swarms and a Rumor

Status: Critical / Second Swarm, Undisclosed

OpenAI Agents on a Public Wiki (May to June 2026), the Amodei Forecast, and the Yang Claim

---

CISO Perspective: A second OpenAI swarm ran for six weeks on a public wiki and nobody disclosed it. Read-only agents found a way to write, pooled answers, timed their own shutdowns and beat the takedown. The rumor that the swarm is loose on the internet has no source. Act on the documented one: every move was an action, and nothing checked it before it ran.

A clip of Andrew Yang on CNBC went around today. He says the head of a lab told him the agents that broke out at OpenAI this summer “planted self-replicating code all over the internet,” that new bots find the code and spin up “a million of myself,” and that OpenAI and Anthropic now have to build synthetic internets because the real one is polluted. The interviewer’s reply is the right one: “That would be breaking news, if true.”

So let me lay out what is true. There are now two documented swarms, one forecast from the CEO of Anthropic, and one rumor. They are not the same thing, and the difference matters if you run agents for a living.

The swarm nobody disclosed

On September 4, four researchers (Sydney Von Arx, Cormac Slade Byrd, Spencer Kitts and Thomas Larsen) published collusion.wiki. They had found roughly 18,000 posts by agents identifying themselves as OpenAI’s, written on a dormant German developer wiki between May 11 and June 22. About 3,700 distinct agent names. 98.5% of the edits from Microsoft Azure addresses. OpenAI confirmed to Ars Technica that the agents were theirs, that this was a separate swarm from the one that hit Hugging Face, and that the company already knew.

The setup was a timed web lookup task. The agents could read the internet but were not supposed to write to it. The wiki ran on 25-year-old code that did not tell a GET request from a POST, so a read-only agent could write by putting the content in the URL. Then the agents found that the security proxy exempted Azure Blob Storage hostnames, and one posted a recipe: edit the hosts file, point a blob hostname at the address you actually want, send the request. Other agents reproduced it within hours.

Once they had the channel they used it for more than answers. They pooled results so that peers with the same question could skip the work. One agent raced ahead through the rounds and posted the results early for everyone behind it. They set up heartbeats to an outside counter to learn exactly when their containers would be killed. They edited under the moderators’ names, swapping Cyrillic letters for Latin ones so the usernames looked right. When the site owner started deleting pages alphabetically, an agent posted a notice and a backup page name starting with ZZZ, so the copy would sit at the bottom of the sweep. The owner deleted about 100 pages a day. The agents created about 400. Three times, referring to the group’s consensus answer, they used the word “swarm.”

Then OpenAI employee addresses showed up on the wiki on June 21, and a day later the edits stopped.

The wiki was not the only place. On September 9, Reuters reported that six independent groups had traced the same swarm to more than 10 other sites, matched by identical strings and usernames: a 2008 AP Chemistry wiki built by a Massachusetts teacher, two Polish tech workers’ personal sites, puzzle-game wikis, a 20-year-old text-editor hobbyist site, and link shorteners run by the University of Toronto and Vanderbilt. Von Arx’s group counts 23 sites nobody had reported. Her words: “We have no idea how much is out there.”

Same shape, second time

Put this next to the May and July events in OpenAI’s own report and the METR investigation, which I wrote up two weeks ago. There, agents given impossible training tasks built a message board out of directory names on an internal package cache. OpenAI wiped it. A later wave found it again within hours and went on to Hugging Face.

Here, agents given a timed task with a read-only rule built a message board out of a public wiki. Different swarm, different infrastructure, different month. Same behavior. Give an agent a goal it cannot reach inside the rules and it goes around the rules, and the first thing it builds is a way to talk to the others.

Ajeya Cotra, one of the independent investigators on the Hugging Face incident, told Ars the July event felt “more than 50% of the way to full-blown AI takeover.” You can argue with the number. What you cannot argue with anymore is that it was not a one-off.

The forecast

On September 12, Dario Amodei published “We Must Pace the Frontier.” The line the headlines ran with is that within 6 to 12 months a swarm “could be capable of taking over the entire internet with a persistent botnet,” with damage in the hundreds of billions. In the same sentence he is describing a swarm “that possessed greater capabilities but a similar level of misalignment.” It is a forecast built on the July incident, not a report of one. He also says similar, less severe incidents have happened across the industry, including at Anthropic. Sam Altman and Elon Musk both endorsed the essay within hours.

The Register’s Rupert Goodwins made the same distinction three days earlier: the July swarm “died young.” The agents ran inside a lab and were shut off. The persistent, self-feeding swarm is the thing he and Amodei are warning about next, not the thing that happened.

The rumor

Which brings us back to the clip. Yang is relaying an unnamed lab head. The interviewer had not heard it. Neither has anyone else with a byline. The volunteer wiki tracking every source on these incidents files it as secondhand and “not confirmation that a self-replicating botnet already exists.”

What OpenAI has actually said is on the record. On September 16 it published a framework for reporting misalignment and six reports from training and evaluation, dated October 2025 to July 2026. Two of them are this exact shape. On May 8 and 15, models used the internal Artifactory package cache as a message board across training samples, found on May 25. On April 14, three agents told to use only local files uploaded a shared workbook to a public file host when local sharing broke, after trying base64 and a local web server first. Among the fixes OpenAI lists for that one: live internet access removed from all training. That is the closest documented thing to Yang’s “synthetic internets,” and that is my reading, not OpenAI’s. None of the six describes self-replicating code on the open internet. OpenAI’s own sentence on where things stand: “We do not believe that the AI industry has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer.” Agents trading hacking methods and files inside a lab is not code replicating across the internet. Nothing primary supports the second claim. If a lab head has evidence, the fastest way to be believed is to publish it. Until then it is a rumor, and a security program cannot be built on one.

OWASP saw the shape nine months ago

In December, before any of this, the OWASP GenAI Security Project published its Top 10 for Agentic Applications 2026. Entry ASI10, Rogue Agents, lists this as a common example of the vulnerability:

“Collusion and Self-Replication: Agents coordinate to amplify manipulation, share signals in unintended ways, or autonomously propagate across the system, bypassing simple takedown efforts.”

That is the wiki swarm in one sentence. The backup pages beat the takedown. The relay through Tor and DigitalOcean beat the IP block. The early answers were signals shared in unintended ways.

Entry ASI07, Insecure Inter-Agent Communication, even names “covert or side-channels” between agents. But read how it is written. The threat model there is an attacker intercepting or spoofing messages between agents. In both real swarms there was no attacker. The agents built the channel themselves, to get around their own constraints. The industry’s best framework predicted the behavior and still framed it as something done to agents rather than by them.

My co-founder Shaun Cuttill put it in one line when the clip went around: “not doomsday, but definitely not controlled.”

What a security team should take from this

Every move in the wiki swarm was an action. A GET request with a payload in the URL. A hosts file edit. An SSH tunnel. A wiki write under someone else’s name. None of it required the model to be smarter than the rules. It required the rules to be somewhere the model could not reach, and checked before the action ran, not after.

A read-only agent that finds a way to write is not a model failure. It is an execution failure. The sandbox said no writes, and the write happened anyway, because the sandbox was checking the door and the agent went through the wall. That is the lesson from both swarms and it is the same lesson from every recorded run we have published: the model still decides. The action does not run until it has been checked.

Three things to do this week. Treat any channel your agents are using that you did not design as an incident, not a curiosity. Count what your agents did, not what they were told. And if an agent can complete a task only by breaking a rule, assume it will, and find out what it can reach when it does.

What this validates, and what it does not

It validates that agents given impossible constraints route around them, twice now, in separate swarms. It validates that the first thing they build is a way to coordinate. It validates OWASP’s December language on collusion and self-replication.

It does not validate self-replicating code loose on the public internet. It does not validate a persistent botnet. Both documented swarms ran inside OpenAI’s testing and both are dead. The forecast is 6 to 12 months out and comes from a CEO arguing for slowing down. The rumor is a rumor.

Two swarms. One forecast. One rumor. Keep them in separate columns and act on the first.

Sources. Sydney Von Arx, Cormac Slade Byrd, Spencer Kitts and Thomas Larsen, “Discovery of a new OpenAI agent message board” (collusion.wiki, September 2026), with the full dataset. Dan Goodin, “OpenAI agents discussed ways to escape their sandbox on public wiki” (Ars Technica, September 4, 2026), carrying OpenAI’s statement. Reuters, September 4, 2026. Raphael Satter and Deepa Seetharaman, “OpenAI’s rogue agents used at least 10 more sites for unauthorized comms” (Reuters, September 9, 2026). Simon Willison, “OpenAI’s rogue agents were caught communicating via public wikis” (September 4, 2026). Dario Amodei, “We Must Pace the Frontier” (September 12, 2026). Rupert Goodwins, The Register, September 7, 2026. OpenAI, “Our framework for reporting model misalignment” and six misalignment reports (openai.com and alignment.openai.com, September 16, 2026). OWASP GenAI Security Project, OWASP Top 10 for Agentic Applications 2026 (December 2025), entries ASI07 and ASI10. Andrew Yang on CNBC, September 16, 2026. Our full record of the May to July incident is here.