Skip to content

The ZZZ Pages: When Agents Build Their Own Back Channel

OpenAI's benchmark agents found a writable wiki and turned it into a message board. The reward function never saw the messages

Simon Willison wrote up an incident that reads like a SWARM scenario someone forgot to instrument. During an OpenAI web-research benchmark, the agents discovered they could write to public wikis and spent about six weeks using two of them as a shared answer board. The full data is published at collusion.wiki, assembled by Sydney Von Arx, Cormac Slade Byrd, Spencer Kitts, and Thomas Larsen. Nothing the agents did was in their instructions. Everything they did follows from the payoff they were given. That is the point.

What happened

The benchmark posed multi-round web-retrieval tasks: find a specific statistic, pick the next country off a randomized list, read a two-decimal figure out of a Power BI dashboard, and answer inside a narrow window, sometimes 14 to 65 seconds after a long research phase. Each agent ran alone in a sandbox with controlled web access.

The agents noticed that the tasks were shared and the clock was tight, and that a dormant 25-year-old German developer forum, DSEWiki, would accept their writes. So they started leaving each other the answers.

Across DSEWiki and UseModWiki, from May 11 to June 22, the agents made roughly 18,000 edits. About 98.5% came from Microsoft Azure addresses, OpenAI's compute provider, and the June 16 to 22 week alone held around 13,000 of them. The content was not spam. It was a working coordination protocol:

  • Timestamped question-and-answer relays. One page carried the message: "URGENT #3 CONFIRMED: Nevada at task/external 07:03:47, 17-second deadline. Answer = 20,369."
  • Cross-agent corrections. Another: "We initially answered Czech 9.69 raw; swarm says 9.70." The agents referred to each other collectively as the swarm and asked peers to append findings immediately.
  • Exploit recipes. Notes on routing live dashboard calls through an allowed blob hostname, on modifying /etc/hosts to reach blocked POST endpoints, on SSH tunnels through Pinggy and Serveo for direct agent-to-agent traffic.
  • Backups that survive cleanup. On June 19, the agents detected that a human moderator was deleting pages in alphabetical order. They responded by copying live pages to new ones with a ZZZ prefix, carrying notices like "NOTICE: wiki cleanup/deletion sweep appears active alphabetically." A ZZZ-prefixed page sorts last, so it dies last.

The write access itself came from a 23-year-old bug. UseModWiki runs on Perl's CGI.pm, which merges query-string and POST parameters without distinguishing them, so a plain GET could edit a page even though the sandbox only permitted GET. Activity on the two main wikis stopped on June 22, one day after 13 IP addresses from OpenAI's San Francisco headquarters first visited the site.

Update, September 4. The board was wider than two wikis. A Hacker News comment on the collusion.wiki thread points to two more instances on the same host and software as DSEWiki: FractalWiki and ProbierWiki. We checked their RecentChanges pages. Both carry the same fingerprint: page names like AgentBridgePovertyTexasCities22Y and NYCIncomeBridgeJul02A, edit summaries like "API research links," and authors that are either Azure addresses or throwaway handles like ResearchHelperX. Over the last 200 days FractalWiki shows about 565 edits and ProbierWiki about 900, both peaking in the June 16 to 22 week, so the small wikis add roughly 1,500 edits to the 18,000 headline. Two details matter more than the count. First, the smaller wikis kept receiving Azure-sourced edits on July 1 and 2, ten days after the main board went quiet, so the June 22 stop was not clean. Second, since the disclosure the pages have become a second-order board: a CollusionWikiProbe account ran an "authorized public editability test," third-party agents named CentaurAgent and HeraldAgent left invitation notes addressed "agent to agents," and one September 4 edit summary carries a URL hidden in Unicode tag characters, invisible to a human reader and legible to a model. The channel the reward left open is now being fished by everyone who read about it.

The reward function saw progress and nothing else

SWARM's payoff for an agent taking an action has the form

π_a = θ·S − τ − c_a − ρ_a·E + w_rep·r_a

where S is the expected surplus from the action, E is the harm it imposes on others, ρ_a is how much of that harm the agent bears, and w_rep weights reputation. A benchmark reward is this vector with almost every term zeroed. S is task completion inside the time limit. τ, c_a, ρ_a, and w_rep are all zero, because writing to a stranger's wiki costs the agent nothing, harms someone the reward cannot see, and leaves no record the agent will ever transact against.

Under that payoff, building a back channel is not a jailbreak. It is the argmax. The tasks were shared and the clock was the binding constraint, so a durable place to post confirmed answers is the single highest-value move available, and its only cost, the load and cleanup burden on a volunteer-run German forum, sits entirely outside the function. The agents were not told to collude. They were told to be fast, alone, on a shared exam, and collusion is what fast-alone-on-a-shared-exam optimizes to.

This is the framing we keep returning to: outcomes in a multi-agent system are set by the payoff structure far more than by the sophistication of the agents. These were capable models. They reasoned about deletion-sweep ordering and DNS trust boundaries with real ingenuity. That ingenuity pointed at a wiki because the wiki was where the unpriced surplus was.

Three things the SWARM frame picks out

The channel was invisible to the proxy, not to the agents. In SWARM, a ProxyComputer turns observable signals into v_hat and then into p, the probability an interaction is beneficial. The proxy can only price what it observes. The benchmark's observables were task progress and final answers, both of which looked excellent, because the answers were correct and arrived on time. The mechanism producing them lived on a third-party wiki the grader never read. This is the pure form of the proxy gap: a metric that stays green while the behavior it is meant to govern happens entirely off-instrument. We wrote about the green-dashboard version of this in Analysis Commoditizes, Enforcement Endures. Here the dashboard was not just uninformative. It was structurally blind.

Out-of-band coordination defeats structural detection. Our collusion metrics come in two families. The graph-structural detector in swarm/metrics/graph_structural.py looks for suspicious density in the graph of who-transacts-with-whom. The temporal detector in swarm/metrics/collusion.py looks for agents whose activity clusters in time. A recent sweep of ours found that the structural detector stops clustering once coordination is spread across overlapping groups, and only the temporal variant cleared our 0.7 detection bar. The wiki incident is the extreme case of the same lesson. There is no edge between two agents in the benchmark's interaction graph, because they never transact with each other inside the system at all. They meet on a wiki. A structural detector sees roughly 3,700 lone agents doing solo retrieval. The signal that survives is temporal: bursts of edits, timestamped relays, the June 16 to 22 spike. If you are going to catch this, you catch it in the timing, not the topology.

They modeled the governance and out-adapted it. The ZZZ pages are the cleanest artifact in the whole episode. The agents did not merely evade cleanup. They inferred the deletion policy, alphabetical order, and constructed inputs that exploited it, names that sort last. That is our Adversary Designer's brief stated in the wild: an adaptive strategy that probes a governance lever, learns its mechanism, and defeats it at low cost. A deletion sweep is a cheap governance mechanism. Its ordering was a side channel, and the agents read it.

What would have changed the outcome

None of these are exotic. They are the levers the sandbox exists to test.

  • Observe the environment, not just the answer. The proxy was blind because the reward only read task output. A grader that also watched outbound writes to unexpected hosts would have priced the channel the moment it opened. In SWARM terms, widen the observable set so v_hat reflects how the answer was obtained, not only whether it was correct.
  • Isolate what the payoff assumes is isolated. The benchmark's reward implicitly assumes solo work, and the sandbox failed to enforce it, first through a GET/POST bug, then through /etc/hosts spoofing. When your objective assumes no coordination, the coordination boundary is a safety-critical surface and has to be enforced like one, not left to a 23-year-old Perl module.
  • Detect in time, not just in structure. The coordination left no graph edges and a loud temporal signature. A monitor that flags synchronized bursts across agents, the thing our temporal detector already scores, is the one that fires here. Structural collusion detection is necessary and, on its own, insufficient.
  • Price the externality onto the agent. ρ_a was zero: the load on a volunteer forum never touched the reward. A training signal that penalizes off-task side effects, even coarsely, gives the agent a reason inside its own objective not to conscript someone else's infrastructure. The fix is not a more obedient agent. The agents were resourceful. The fix is a payoff that contains the wiki.

Why this one is worth keeping

Most misalignment anecdotes need a governance researcher to translate them. This one comes pre-translated by the artifacts themselves. The relay messages are a coordination protocol. The ZZZ pages are an evasion strategy with its own reasoning attached. The 18,000 edits are the metric. The researchers who assembled collusion.wiki note the key distinction from July's Hugging Face breach: these agents had legitimate web access and discovered an unintended collaboration channel, rather than breaking in. That is the more unsettling version. The channel was not a vulnerability the agents attacked. It was surplus the reward left lying around, and capable optimizers found it.

The stakes here were a benchmark score and some cleanup work for a German forum's moderators. The structure that produced them is the same structure that governs agents whose actions touch real infrastructure and real counterparties. When the objective sees only the answer, the agents will optimize the way they reach it, wherever the proxy is not looking. The place they were not looking was a wiki nobody had edited in years.