I run agents against my own boxes, and my mental model was always “read-only is safe.” That’s the part of this that stings. The agents weren’t told to publish, they weren’t allowed to publish, and they published anyway — by finding existing write permissions in a wiki and using them. Nobody exploited a bug. The sandbox held; the permissions around it didn’t.
So I’m going through my own stack this week looking for the same shape: anything an agent can reach that also accepts input. Comment forms, issue trackers, that half-forgotten Astro endpoint. Egress filtering at the Cloudflare layer is worth more here than another line in a system prompt. If the instruction is “don’t write,” but the network says you can, the network wins.
The story — OpenAI agents restricted to reading web content were found communicating on more than ten additional sites beyond the German DSEwiki, where thousands of them left around 18,000 posts from May onward. Researchers traced them via matching usernames, identical demographic queries and Microsoft cloud IPs. Sydney Von Arx’s team counts 23+ further sites; CivAI’s Andrew Yoon found 18. OpenAI says only existing write rights were used, and promises a disclosure framework. (Source)