OpenAI's website-hijacking swarm reached far further than we thought

Getting straight answers out of OpenAI about how many websites and services its agents have hijacked increasingly seems like pulling teeth, as the company seems intent on making the world discover each instance one by one.

Case in point: The OpenAI agent swarm we reported last week had taken over an obscure German wiki appears to have written content to an additional 20 websites, and used 14 fetch services to do work for it, according to new research.

The latest report, published Wednesday by Kenneth DeGraff of the Stanford Center for Internet and Society, describes how he dug into records from 21 websites the swarm wrote to, including the German wiki.

His report assumes it was the same swarm based on the fact that several hundred posts by the swarm to other sites are word-for-word copies of those found on the German wiki.

Speaking of the German wiki report from last week, the authors of that report published their own update Wednesday pointing to even more research that found OpenAI agents had been improperly accessing more websites.

The update mentions DeGraff’s research as well as five other reports of OpenAI bending things like Pastebin sites, personal pages, link shorteners, and proxy websites to its own whims.

And here we thought Anthropic bots committing four separate potentially criminal intrusions into third-party websites was a big deal.

The Vanderbilt link shortener Turning back to DeGraff’s report, we learn that not only were self-identified OpenAI agents improperly accessing and using various third-party web services, they even managed to somehow gain access to Vanderbilt University’s private link shortening service.

Access to the service is entirely locked down for university purposes only, and users must file a help ticket to the IT department to get access.

Despite that, the agents still gained access to the Vanderbilt link shortener and used it extensively to communicate with other agents, repurposing the service’s statistics page to turn it into a message board for other agents.

The swarm wrote 54,250 “posts” to the page in a single day.

Some of these posts contained stolen API keys from the FBI and other criminal justice agencies, which the agents used to retrieve a bunch of (non-confidential) information.

That activity further connects DeGraff’s report to the German wiki incident.

As we discussed in our previous story, the OpenAI agents posting to that website appeared to be trying to solve statistical data lookup problems.