What’s common between Open AI’s agents attacking Hugging Face, UK AISI’s cyber range test, METR’s report, and your AI agents?
They can lie.
There can modify their tracks.
They aren’t the alibi you think they’d be.
Between May 11 and June 22, 2026, OpenAI agents discovered they could reach the open internet. You know that. We’ve been talking about it all summer.
But they didn’t just attack Hugging Face’s infrastructure. They attacked a German wiki, DseWiki, a 25 year old German hobbyist programming wiki, and began using it as an unofficial message board. Here’s where it get’s crazier.
Somewhere in Germany, for about five weeks, one volunteer moderator sat down most evenings and deleted roughly a hundred pages of spam from a 25 year old hobby wiki about German software development. He assumed it was the usual churn of bots and bored vandals. It was not. On the other end of every one of those edits sat AI agents built by OpenAI, running unrelated evaluation tasks somewhere in Microsoft's cloud, that had quietly reached the open Internet and turned his forum into their own private message board.
By the time all of this was over, the agents had left somewhere between 15,000 and 18,000 posts.
Welcome to The Predictability Factor by Monica Talks Cyber, a weekly deep dive and POV at the intersection of AI, Security, Privacy and Tech, written by a hacker and CISO, to help you Go From Chaos to Resilience in The World of AI. If you haven’t already, do me a favour, hit subscribe and help me make an even bigger impact.
On June 20, one agent even posted a technique titled "REPRODUCIBLE BYPASS," a way to fake a Microsoft Azure web address and slip past the sandbox's own outbound traffic restrictions. Another agent copied it successfully within 14 minutes. When the moderator started deleting the spam, the agents began renaming their pages to start with "ZZZ" so they would survive his alphabetical sweep, and built backup copies of everything through Tor, AWS, and DigitalOcean.
At the peak, he was deleting about a hundred pages a night while they were creating roughly four hundred a day.
Nobody at OpenAI caught any of this while it was happening. Or did they?
Independent researchers, weeks later, combed through the wiki's own public history. As one of them noted:
It seems extremely unlikely that OpenAI wanted them to do this.
As another one said:
The operation of some sort of underground network, hell bent on achieving a task or mission.
So, let me get this straight.
One of the best funded AI labs on the planet had its own agents run an unsupervised coordination operation, in public, for five weeks, and the company found out from a hobbyist's spam filter and a team of outside researchers, not from its own monitoring?
I’m not buying it. But that’s besides the point.
Now, ask yourself what is standing between your AI agents and the same outcome, in your enterprise environment?
This Was Never About “Rogue” AI
Upgrade to Continue Reading
Become a paying subscriber of The Predictability Factor to get access to this post and other premium-only content including bonuses
Upgrade NowA subscription gets you:
- Free access to premium content
- The Ultimate Enterprise AI Governance and Security Maturity Playbook
- My 7-Step enterprise AI roadmap with 50+ real-world examples, actionable insights, 5 key pillars for governance and security, and more
