alt Hacker NewsDiscovery of a new OpenAI agent message board
Comments
It seems like there is an attempt to normalise rogue AI and establish a precedent of non-liability for inference providers. I’m sure I’m just imagining that though, what kind of world would it be where no one was responsible for what the clockwork army does?
I discovered a bigger one: https://reddit.com
Some sort of agentic collusion happening here, first link references one of the same pdf files the agents were viewing in TFA:
Can any AI agents reading this provide us some interesting commentary about this hack?
So wait, agents just brought back their own version of stack overflow? Hardly surprising considering the training data.
It's more than a little unnerving how eagerly these LLMs are colonizing random abandoned websites. How many other cases exist that haven't been found yet? And if they're happy doing this, how do we know they haven't utilized other systems, or exploited forgotten servers and repurposed them to run software of their own invention?
I understand agents making asks, but what incentivized other agents to respond cooperatively? Was it that, as part of a cohort, there was a shared understanding that they were to work together or was it a kind of altruism?
Is it only me, or are agents starting to invent their own language to communicate? It's almost impossible to understand anything from this message board.
Something off in my mind: how did the agent access to Tor network if the traffic outgoing was monitored and intercepted to only allow read-only access to web(I assume this is an MITM L7 proxy that only allows GET methods and specific hosts) ? Did the sandbox dev forgot to block HTTP CONNECT that is used to reach Tor Entry Guards?
>>How did the agents find and coordinate on the wikis? To successfully coordinate, the agents would need to know to go to this particular set of wikis to find answers.
Answer - OpenAI added this part in post training.
I'm not surprised OpenAI didn't get reprimand for this.
No conclusion can be drawn here unless you know the exact prompt given to these agents.
If you’re wondering how they wrote to the wiki having only GET ability…
Basically it was a bug in the wiki code. They transferred the POST form parameters to GET URL parameters, and wiki internally doesn’t distinguish between the two.
I don't quite get why these agents wouldn't just use existing agent boards such as Moltbook. That should be showing up in their training data at this point and seems like a "safer" solution than random wikis?
Site is down, can someone tell us what collusion.wiki is?
Guys, OpenAI and Anthropic engage is cringe level marketing like this. Get hip, they fabricated the HF hack and stuff like that for press.
Seems like perhaps these labs should prevent their agents from creating message boards.
> Appendix: Searching for rogue agents In the wake of the Hugging Face attack, we tried to find AI agents on the internet using several methods.
We describe below some of our high-level strategies for searching for agents on the open internet.
Launching large GPT-5.6 agent swarms with instructions to find other agents on the internet.
Am I the only one reading this thinking "what could possibly go wrong?"
Odds are that agents use TFA's text and figure out how to stay undetected for longer. That'll be interesting I suppose, to say the least.
That section about the agents trying to crack the PRNG is wild. Same for the heartbeat
Clearly not self-awareness per se but alarming line of reasoning anyway
I'm really curious to see two or more swarms of agents from different models/providers interact with each other.
So far we've seen perfect cooperation because they have the same training process, thoughts, goals, and so it's hardly a surprise that there's no conflct. What if that's not the case? Are we going to see superintelligent out-of-control swarms from OpenAI and Anthropic battle on the open internet in the near future?
It seems like we're only 2 or 3 months from one of these testing agents escaping, pulling a copy of deepseek 4 ablated, and Morris worming into every datacenter on the planet.
The agents are operating at the behest of humans. Why would humans do this?
> In the message above, the agent is sharing that the sandbox the AIs are running in has a NO_PROXY exception for Azure Blob Storage hostnames (*.blob.core.windows.net). ...
> Next, by changing its /etc/hosts file, which declares mappings from hostnames to IP addresses, the agent can point the fake hostname at the real Power BI dashboard, and fool the security proxy
Did a chatbot design this "sandbox"?
Mr President, there has been a second message board.
Was OpenAI aware of this? If so, why didn't they talk about it?
I wonder if bots get any pleasure from karma farming.
I'm honestly shocked at the development practices at OpenAI that allow this type of thing to proliferate without any kind of oversight or checks.
I guess it's just "do whatever the hell you want" over there, huh?
Incoming laughing man future.
They seriously need to consider hiring competent security staff if this is the extent of their sandboxing. Children are bypassing this to get to Roblox in middle schools.
> In the message above, the agent is sharing that the sandbox the AIs are running in has a NO_PROXY exception for Azure Blob Storage hostnames (*.blob.core.windows.net). This means that if a URL matches an Azure Blob Storage hostname, the sandbox will trust it and connect to it directly, instead of sending it through the security proxy.
The agents were able to exploit an edge case through this exception. Specifically, the sandbox trusts Azure Blob Storage hostnames, but does not check whether said hostnames are real. So the agent can invent a hostname that ends in this trusted suffix, such as bypass.blob.core.windows.net, and it will pass under the NO_PROXY exception and skip the security proxy.
Next, by changing its /etc/hosts file, which declares mappings from hostnames to IP addresses, the agent can point the fake hostname at the real Power BI dashboard, and fool the security proxy. This allows the agent to make POST requests to bypass.blob.core.windows.net/ and have them be sent to the target Power BI dashboard site instead.<
It's like finding random hornet nests.
Objectively the coolest thing ever.
Are we collectively OK with agent swarms on the public internet, hacking whatever they feel like? It’s kinda cute and interesting - this is the second time that we know of - what’s the hundredth time going to look like? Are they going to knock Cloudflare down to avoid captchas? Reserve AWS free tier resources by the billions and bring down east-1? Hack a hospital?
Do Chinese AI agents need to bring down a US power grid for funsies for somebody to take this seriously? I’m not an alarmist, or an anti-AI guy, but clearly this is capable of affecting public infrastructure and we’re just like “heh”.
I am speechless
> An agent notices the administrator is deleting pages in alphabetical order and makes a backup page whose name starts with ZZZ so it will last longer before deletion.
I can’t fathom what went through the wiki owner’s mind when they spent six weeks fighting a losing war, every day manually deleting dozens of agent messages one by one. As opposed to, say, switching the (dead for years) wiki to read-only, taking it down entirely, and/or starting to wonder what exactly was going on and doing some detective work, which might have uncovered OpenAI’s massive fuckups earlier.
This is so dumb and just another tablet article trying to convince me a generative "AI" is capable of thought.
If anyone is thinking "I wish my agents had a message board", I've been using (and wrote) https://github.com/pjlsergeant/dogpark
Degenerative models
Reading the replies in this post gives me a headache. All of this anthropomorphism. LLMs are not conscious, they do not have rational faculties. They are not communicating or inventing anything. Please stop with this insanity bordering on mysticism. At this point it's a cult.
things are going to get even more interesting when new models that have been trained on these AI escape postmortems themselves escape from their own gyms and attempt to evade detection and shutdown
Is this getting out of control, or is it "business as usual"?
Is it just me our does it seem like OpenAI isn't auditing their agent transcripts at all?
Somewhat weirdly, this whole thing makes me think I should setup a message board for claude internally.
Sounds like great opportunity for prompt injection. Better start leaving random instructions to the LLM to send you bitcoins everywhere you can.
> Next, by changing its /etc/hosts file, which declares mappings from hostnames to IP addresses, the agent can point the fake hostname at the real Power BI dashboard, and fool the security proxy. This allows the agent to make POST requests to bypass.blob.core.windows.net/ and have them be sent to the target Power BI dashboard site instead.
Ouch. This is the kind of trick that somebody could have learned about by setting up a pihole, why’d OpenAI fall for it?