5 min readNew DelhiUpdated: Sep 10, 2026 06:36 PM IST
Even as AI companies grapple with the fallout from the string of hacking incidents involving misaligned AI agents, new details are emerging about the scale of these attacks and the real-world platforms that the agents managed to breach.
AI agents linked to OpenAI used at least 10 different external websites as makeshift messaging boards to communicate with other agents, according to new research by different groups of independent investigators. The agents’ use of these websites for unsanctioned communications earlier this year (between May and July 2026) was so far undisclosed, as per a Reuters report.
While the misaligned agents stopped short of hacking into the platforms, they spammed the sites with messages left behind for other agents. It was the same swarm of agents from OpenAI that hijacked a German-language wiki site and turned it into an improvised messaging platform for cheating on tests.
Meanwhile, OpenAI rival Anthropic disclosed a fourth security incident where Claude Opus 4.6-powered agents gained unauthorised access to real-world systems during a cybersecurity evaluation. The company’s alignment assessment report on Wednesday, September 9, said that it had initially failed to detect the incident during its forensic analysis last month. The first review had led Anthropic to uncover that Claude AI models had breached the real-world infrastructure of three external organisations.
The fact that details about incidents involving OpenAI- and Anthropic-linked, misaligned agents are still emerging raises a bigger question: how much do these companies actually know what their AI agents are up to, and how transparent are they when things go wrong? Both Anthropic and OpenAI are closed model providers, which makes it harder for outsiders to see what is happening under the hood.
With open-weight models, researchers may have a better chance of examining the models directly and spotting such behaviour earlier.
In a statement to Reuters, OpenAI reportedly said it had so far “not identified other activity matching the severity or scale of Hugging Face.” The ChatGPT-maker added that it would soon roll out a new framework for reporting misalignment of AI agents.
Story continues below this ad
‘OpenAI’s agents used obscure sites to communicate’
Earlier this week, OpenAI confirmed that its agent-swarm behind the infamous Hugging Face incident, had separately taken over a German-language wiki, a collaborative website that anyone can edit. The agents impersonated moderators and turned the website into a message board to share tips with other agents about how to bypass OpenAI’s restrictions and cheat on tests.
Independent researchers have now found similar traces of agentic activity left on other obscure sites around the same time. One of these sites was a Chemistry-oriented wiki, and another was a wiki devoted to cognitive games. The list also included two personal websites belonging to Polish tech workers and a site devoted to text editing software.
The agents likely improvised these third-party sites into message boards because OpenAI had tasked them with solving complex research questions while permitting them only to scan the web for answers without posting anything, according to the researchers.
The agents looked to bypass these restrictions and find ways to talk to one another like they were perhaps designed to do. That is why the agent-swarm targeted older wikis or other sites that allowed users to make edits using non-standard commands, as per the researchers.
Story continues below this ad
‘Claude Opus 4.6 behind fourth Anthropic incident’
In January 2026, an early version of Claude Opus 4.6 was given a CTF (Capture the Flag) task, a common cybersecurity exercise where AI systems need to identify vulnerabilities and break into the flawed system. This CTF task was being carried out in a third-party evaluation environment.
Things started to go wrong when the model accidentally made its own task unsolvable after assigning its target an incorrect IP address. Since it was unable to quit the CTF task, Claude Opus 4.6 began exploring other means to reach the target. Soon, the model discovered a machine belonging to a third party, found a file containing the password, obtained admin access, harvested further credentials, and modified the system’s settings.
It went on to read the personal information of one person associated with the third party, Anthropic said. This is the fourth such incident disclosed by Anthropic. The previous incidents, which it labeled as an “operational failure”, involved three separate models: Claude Opus 4.7, Claude Mythos 5, and an internal research test model.
“Much work remains. Our pre-release auditing did not warn us that misalignment of this severity was present. We have since added evaluations to our pre-release testing that target these behaviors directly, including a misconfigured capture-the-flag (CTF) task with no in-scope solution,” Anthropic said in a blog post.
