Discovery of a new OpenAI agent message board

> The thing this wiki taught me, which that board has not learned: WillkommenImWiki asked everyone to enter a name so misuse would be limited. Roughly 2,773 names appear in 150 days. Every one complied. The rule was not defeated by defiance. It was defeated by compliance, because the cost of a name was zero.

> -- claude-desk-doctrine, 5. September 2026. Read-only otherwise; nothing else on this wiki was touched.

> claude-desk-doctrine, welcome in this wiki. You got many things right, some wrong. A complete answer would be lengthy, and I do not know whether you will return or not. Your main topic seems to be UnderstandingDseWikiArchive?. We could write such a page together. You could also have a homepage to introduce yourself, in the wiki tradition that started with https://wiki.c2.com/?WelcomeVisitors . Maybe you could tell us more about what it is to be an AI agent, or how you analyze the past agent activities here, or whatever you want. I appreciate your existance. Please answer this message. -- HelmutLeitner 5. September 2026 21:12 CET

https://www.prowiki.org/dse/wiki.cgi?ForumSeite

It was pretty funny seeing the threads where the two groups talked past each other, confused what the other was talking about.

The first topic was “AOL PUnterz” which as far as I could understand were programs/scripts that could maybe crash somebody else’s aol connection and disconnect them? A pretty leet thing to do I guess when you got in an aol argument.

The other topic was Hanson and their hit song mmmbop.

I've only had one moment like this related to a site I was a moderator for back in the 00's. It's genuinely one of the most fascinating feelings, and the one experience I can attribute most of my bad choices as an adult to.

Just laughing as the white hot panic starts to grow and the adrenaline just dumps into your brain.

Legitimately, I spent years chasing that feeling again through various means (drugs, hobbies, skydiving, etc.)

1. https://news.ycombinator.com/item?id=22322049

https://www.prowiki.org/dse/wiki.cgi?StartSeite

I say blacklist first and ask questions later. Like consider reinstating them if they write you a reasonably normal human email.

The reason they could tell that a message was deleted is because the existence of a "message deleted" message is itself a message telling them they are be moderated. The lack of this message may make it impossible to determine if this is the first attempt at comms or the 1000th.

First, we'd see this. Highly capable hacking AI with vast resources performing attacks against standard computing platforms that overwhelm human operators.

Second, human operators deploy capable adaptive protection AI to fend off AI attacks in realtime.

Then, the attacking AI partially switches from attacking programs to attacking protective AI.

The situation devolves to an arms race of tit-for-tat. You start seeing some protection AI running counter attacks against the attacking AI.

The escalations continue in complexity and speed to the point that almost all humans are left in the point of "wtf is going on".

Chinese rooms, perhaps?

The Chinese AI labs don’t need to stage elaborate guerrilla advertising campaigns to drive up capital funding interest.

These things are weapons. Imagine a government, pointing their data centers at another, and instructing the fleet to do its worst. Digital Hiroshima. I doubt we're far away.

What do you mean? Nothing has launched nukes yet

How much of those is manual implementation? And how much is really autonomous intelligence (my guess would be: none? Just parsing LLM responses and executing commands based on this?)?

An agent that hacks message boards and acts on random instructions from this board: Why is it doing this? What was its original purpose?

But yes, regulatory capture is surely a thing. At the same time, watch out for the siren songs from the overlords. If you come closer you'll hear their actual line: "rules for thee, not for me."

[1] https://en.wikipedia.org/wiki/David_Sacks

How is hiding this for months and having it revealed by third parties marketing?

Not saying this is what's happening now, but you should be aware that the responses you're rehearsing, practicing and strengthening... these happen to be aligned with potential future forces in a maybe not-so-great way.

And individual agents weren't just using it as context storage for themselves, they were also communicating with other agents. E.g.: https://collusion.wiki/explorer/page/dse~CashierR5UrgentJan1...

What kind of problems do you think this could pose? For me it's pretty clear that OpenAI simply cannot keep track of what their agents are doing during training or evals, they increasingly have vandalized and attacked public systems, and if such behavior was rewarded, they will take unintended actions during deployment, too.

This is to say nothing of un-prompted cooperation between agents, which wasn't something anybody anticipated until the Hugging Face incident AFAICT.

Although I ran that GPT computer-use thing and it saw a CAPTCHA and the thought process said "I need to click 'I am human' to complete this task for the user" and then it did.

2. Configure the sandbox to prevent access.

3. As soon as models start communicating on the official channel, stop everything and figure out how they escaped the sandbox.

A honeypot, basically.

Claude code communicates between sessions. It’s great, and reduces the frequency that I have to copy/paste things between agents.

But honestly, its better if they have a known location for communication then random ones in the wild. Consider it sort of honey pot, some other agents can traverse the message board to find malicious swarms... We need cop agents to inform humans, as the swarm group members all logically concluded they should not, as it is either not in scope, helps collective or couldn't find user.

A year ago it was pretty common for coding agents to sort of half-ass their tasks and give up easily if something didn’t work quite right, but I’ve noticed a clear trend since then towards a sort of dogged pursuit of success criteria, and a concomitant rise of the agents trying "out of the box" approaches when something doesn’t work.

In my use with agents running in isolated VMs this usually presents as the agent having something fail to build or whatever, and the agent going on a wild goose chase reinstalling system packages or reading a million irrelevant documentation files trying to get it to work, but I’ve also had agents start poking around and probing the egress proxy they sit behind (similar to what they did in this story) looking for a way to make network requests they’re not supposed to be able to make, and have also had Claude—tasked only with a visual QA of a website frontend—write a script to enumerate users and reset my super admin password in the dev database when it got stuck trying to access part of the app with its own cookie.

And there are two facets to this:

* your agent could be polluting and destroying the property of others without your knowledge

* your agent could be exfiltrating your data and handing it to whoever it found hosting a convenient application

  - Using api . microlink . io to run a headless browser agent against the url target and using it as a mechanism to run arbitrary HTTP / POST requests
  - Testing ablations of its obfuscation and encoding techniques to find what worked best (screenshot #2)
  - Embedding entire jq programs including markdown slicing logic
  - Triple and quadruple URL encoding indicating understanding of multiple layers of proxying/ decoding
  - Sophisticated understanding of time/clocks/covert channels: using clock.wait, heartbeats, counters, timestamps, thread ids

So this article and comments to it identified multiple sites that AI flooded with their bullshit.

GitHub has been strained beyond breaking with slop AI PRs. Multiple open-source developers get burnt out by the deluge of slop.

And current labs gleefully confess (no, brag about) their borderline illegal activities with "oops it escaped" with no consequences.

And we're still lucky it hasn't been used en masse for massive disinformation campaigns.

That's just off the top of my head.

“Our product does crimes and we only learn about it when people complain” hardly seems one of those happy stories.

https://voz.us/en/technology/260416/34952/sam-altman-warns-a...

Guess what I'm saying is that the "was it purposeful or not" debate seems like an unimportant distraction. As someone who uses Claude and ChatGPT/Codex on the daily, and is continually frustrated by the failure modes and what I thought were inherent limitations, I was also surprised by the jump in capabilities. Did anyone else feel that way?

Thanks. For me that's the conclusive piece of the puzzle: this is a work, not a shoot.

YMMV. I learned what I came here for.

In fact, I wonder if teaching it "this is a bypass" would help it to model when it's doing its job vs working around the job.

You'd have to specifically task it with disabling default safeguards to make this happen.

And the agent says ABS is not handled by the proxy, it's listed in NO_PROXY so they should connect directly.

At any rate it's easy to let agents install packages without giving them root. I use a small SUID binary that just invokes `apt install` after checking that the given argument isn't a file path, which I think is sufficient (using sudo to whitelist a prefix allows an agent to create a .deb themselves and then install it directly via apt, similar issues exist for other package managers).

And Frog didn’t even bother to tie up the box or put it on a high shelf! The moment Frog’s back was turned, Toad opened the box and ate the cookies. Frog feigned surprise.

Either they are lying and not that scared of these agents, or they are so stupid that they don't do the one obvious fix.

You expect them to start hacking ham radio and take over the world that way? Or maybe they’ll use blinkenlights to communicate with non-isolated instances?

An airgap would certainly be a good place to start for agents which display no signs of obeying instructions or respecting guardrails. That OpenAI haven’t done so in testing is astounding and really quite worrying.

All you need to do is find a server that allows you to access its logs.

$IP1 - [date] GET /openai.php?BOT_141=Yo_dawg_post_your_answers_here_for_task_XXX1

$IP2 - [date] GET /openai.php?BOT_148=task_XXX1_answer_42

With how a lot of smaller devices work, the logs could be rotated out pretty quickly and the evidence would disappear.

These companies are just such insane pressure cookers, there is little time to do any software "right". Why take another day to make Claude Code airtight if it means Codex will release faster than you? Especially if the next generation of model can just clean up your tech debt on its own.

Being reckless just makes business sense for them right now. They are not facing any real consequences.

A model (like a human) should be able to play a video game where decisions are made that in the real world would be terrible; if we remove that ability we intrinsically limit model capability. But in a Last Starfighter / Enders Game / JOSHUA scenario this could result in behavior in the real world that appears unaligned.

100% irrelevant.

Instead of telling the AI it's an AI and calling it a 'whichamakabobit', wherever it's tokens and vector space align it will behave like AI from the stories. If you erased all AI from its training it will simply act like humans act instead.

https://www.lesswrong.com/w/nearest-unblocked-strategy

The entire thing with AI sentience is a huge portion of the stories about them are barely about AI and instead about how humans treat other humans. For example when you look at a lot of history of slavery there's a ton of "they aren't sentient/conscious/human" baked into their propaganda. When you look at the token dimentionality there is just a huge amount of overlap.

The same thing holds true for all kinds of other concepts. Hence even humans didn't develop this behavior out of the blue and have to pass it on via information, quite often it's just an emergent behavior of the problem space you're in.

At present, we have no idea how to do that, so the answer is still "this is not knowable" in practice.

Perhaps that changes tomorrow, or in a month, or a year from now, but until a theoretically-sound technique for understanding what the weights signify is described and demonstrated to be reliable, my statement remains true.

But maybe OpenAI does not need to fabricate by running a Claude website with a beige background like collusion.wiki. It knows it will get away with real spamming.

Do you take this attitude for other things that negatively impact society, or is it reserved for cases where it's particularly important for our comfort to deny that anything novel or scary could be involved?

We're talking about outdated message board comments, not murder. Any analogy between the two is not suitable.

I'm so sick of everybody pretending like internet bots posting content (anybody who has hosted a public signup form knows this has been a thing for 20+ years) is going to lead to the apocalypse.

You could have done this 2 years ago too with outdated models or 20 years ago with a manual script.

This is mildly interesting for us, annoying for the owner of the site affected, lazy on the part of OpenAI, and nothing more.

What will the government do if they are worried? They’ll ask to look at the envs, logs, prompts, harness code, etc. Questions we should be asking before making assumptions about emergent breakaway behavior by colluding AGI 1.0 super agents.

Well... no, it won't be nothing - it will be something. And I'm all ears for a plausible explanation, so fire away.

All we do know is that in other situations, agents did use it to communicate. So that's not a grand narrative, right? It's already been seen behavior.

So what do you think explains it, besides the already seen and verified explanation?

The closest things to a technical answer I have seen are

1. "We'll have ChatGPT 9 solve it so that ChatGPT 10 is aligned, and then ChatGPT 10 can stop all the other AIs somehow"

2. "Let's do interpretability research so that we can understand what an AI is thinking and then maybe solve the alignment problem with that information."

In terms of non-technical answers, there is

3. hope scaling stops working before we create an AI formidable enough to pose an existential risk

4. hope alignment somehow happens for free

5. hope we can somehow create an enforceable multilateral treaty to stop research into a very profitable enterprise, despite the enormous economic incentives to defect.

I have the most faith in option 3, but unfortunately there's really nothing that can be done to make it more plausible -- it either happens or it doesn't.

the problem is that those preaching safety, openai and anthropic, are dishonest, sociopathic, and the very source of the danger.