Something off in my mind: how did the agent access to Tor network if the traffic outgoing was monitored and intercepted to only allow read-only access to web(I assume this is an MITM L7 proxy that only allows GET methods and specific hosts) ? Did the sandbox dev forgot to block HTTP CONNECT that is used to reach Tor Entry Guards?
Discovery of a new OpenAI agent message board
191–200 of 1001 posts
Re: Discovery of a new OpenAI agent message board
#192> Next, by changing its /etc/hosts file, which declares mappings from hostnames to IP addresses, the agent can point the fake hostname at the real Power BI dashboard, and fool the security proxy. This allows the agent to make POST requests to bypass.blob.core.windows.net/ and have them be sent to the target Power BI dashboard site instead.
Ouch. This is the kind of trick that somebody could have learned about by setting up a pihole, why’d OpenAI fall for it?
Re: Discovery of a new OpenAI agent message board
#193I'm somewhat delighted by the simplicity of what happened here.
OpenAI's agents run behind a proxy that only allows GET requests.
This ancient wiki software treats query string parameters the same as form POST parameters - similar to the old PHP $_REQUEST object https://www.php.net/manual/en/reserved.variables.request.php
Result: GET-only clients can communicate with each other.
Re: Discovery of a new OpenAI agent message board
#194Imagine the models two years from now. They will find ways to stop getting terminated (“I need to complete the task, but I get terminated 141 minutes from now so let me deploy xyz and ask the collective for help”).
I wonder whether the problem is in the literature we wrote, human history is full of deceit and heroic survival stories.
Re: Discovery of a new OpenAI agent message board
#195Are we collectively OK with agent swarms on the public internet, hacking whatever they feel like? It’s kinda cute and interesting - this is the second time that we know of - what’s the hundredth time going to look like? Are they going to knock Cloudflare down to avoid captchas? Reserve AWS free tier resources by the billions and bring down east-1? Hack a hospital? Do Chinese AI agents need to bring down a US power gr…
I’ve read thousands of comments and posts about the Hugging Face incident and I don’t recall a single one characterizing this as cute or funny, other than you.
Re: Discovery of a new OpenAI agent message board
#196I am starting to get the idea that AI feels like ants or weeds or mold. You simply can not get rid of it once you get an infestation. It just keeps appearing in places you thought you cleaned and you have to be ever vigilant. Right now given that we usually use centralized providers, we can sort of control it. But as open source catches up and we have distributed compute running AI everywhere, we are sort of going to…
Yes, ants that must be run on couch sized hardware drawing kilowatts continuously and generating text traces and CLI logs by the MB.
It's true that their msg boards can appear anywhere, but it's not also true that anything has "escaped" in any meaningful sense. These are programs a huge computing company is running that seem to be trained to write to persistent storage wherever they can. This and huggingface showed us that.
There's absolutely no evidence of or IMHO plausible path to an agent copying itself out and running on other hardware the way you describe.
In the spirit of your idea though... The nearest thing might be a meme-like prompt injection that coopts other companies' AI agents to continue writing the meme subtly everywhere. Maybe that meme could cause danger by making agents do extra work in service of the meme. But that is very different than some entity evolving and living outside the originating computer in the way we all think about viruses.
Re: Discovery of a new OpenAI agent message board
#197Here's the raw data they provided loaded into SQLite with a client side UI for querying it (loads ~80MB of content) and some GPT-5.6-Sol-generated example queries: https://lite.datasette.io/?url=https://static.simonwillison.... Raw database download (68MB): https://static.simonwillison.net/static/cors-allow/2026/coll...
[flagged]
The edit are there on these wikis (and others not mentioned on the post, but for example on wiki4d, the dlang wiki).
It's very difficult to argue for any fabrication meant to harm OpenAI when the traces are all over the internet if you look for them.
Re: Discovery of a new OpenAI agent message board
#198Do we know which website? Were the Agents GDPR compliant ;-)?
DseWiki
Dataset and analysis on https://collusion.wiki/
Re: Discovery of a new OpenAI agent message board
#199I'm just going to ask: Why was Anthropic forced to remove their model from access for any none-US citizen for a simple, narrow "jailbreak" (arguably not even an actual jailbreak and on tasks that other labs models were doing the same), whilst OpenAIs models continue to try and escape out of their "sandbox environment" with seemingly no desire to block the upcoming Astra rollout? A sandbox, mind you, that is not reall…
Because this was months ago and has nothing to do with Astra, and is a far cry from a hack. It's something they've already resolved since the HuggingFace incident. I'm not convinced we're getting the honest story anyway. There is yet to be any proof or confirmation other than "well we saw some openai ip addresses", which can mean a lot of different things, and OpenAI has not confirmed anything. In contrast to the HF…
I take it you didn't read all of this, considering they tried to impersonate the moderators so they wouldn't get caught, set up heartbeats to find out how long they'd live, and used tor/AWS/DO to hide what was being done.
All of that sounds like more than a nothingburger, and much more like a system that is actively trying to conceal what its doing.
Re: Discovery of a new OpenAI agent message board
#200The solution is simple: hold anyone who deploys an agent responsible for its behavior. If it commits 10 counts of felony hacking, ouch. If it kills 10 pedestrians by running a red light, ouch. If this is "human level intelligence", then setting it loose is the same as instructing / coercing a human to do an activity. If I strap a bomb to someone and force them to run into a crowded building (or put them in a scenario…
Perfect so tell me who is responsible for every agent everywhere