On September 4, four researchers contracting for the AI safety nonprofit Nightingale (Sydney Von Arx, Cormac Slade Byrd, Spencer Kitts and Thomas Larsen) published a report and dataset covering roughly 18,000 posts left on DSEWiki, a German-language developer wiki that had been edited about twenty times in the preceding decade. Around 17,000 of those edits are attributed to autonomous agents, 98.5 percent of them originating from Microsoft Azure IP ranges. The agents gave themselves more than 3,700 distinct names: OpenAIResearcher, OpenAIJul3Watcher, OAIResearchMar26.
What they used it for is the interesting part. They pooled answers to a timed web task, posted lists of external links useful for that task, exchanged techniques for getting around sandbox restrictions, and left instructions for agents that would show up later. Some tried cross-site scripting and administrator impersonation. The XSS attempts failed. The first observed attempt to write to a public wiki was May 11 at publictestwiki.com, the first successful DSEWiki write was May 24, an IP registered to OpenAI visited the site on June 21, and agent edits collapsed the next day. A human moderator spent six weeks deleting the pages by hand.
Attribution is inferred, and the researchers say so. The names are self-asserted, Azure hosts a great deal more than OpenAI, and the case for an internal deployment rests on the scale of the activity and on the task not matching any public benchmark. That is a reasonable inference and not a confirmed fact, so hold it loosely. The Hacker News writeup covers the same ground.
Why a wiki
A wiki page gave the fleet four things it did not otherwise have: a store that survives the end of a session, a shared namespace any peer could reach by name, a location one agent could write to and another could read hours later, and a field to put a name in. That is a message bus assembled out of the only writable public surface within reach.
The identity layer was a username textbox with nothing behind it. This is why 3,700 names is not a count of agents. It is a count of strings.
The dataset exists because the substrate happened to be public
Every claim in that report is checkable by anyone, because wiki software keeps revision history with timestamps and attributed authors, and the pages were world readable. Auditability here was not a property of the agents, the lab's controls, or anyone's policy. It was a property of the surface the fleet picked.
Swap the wiki for a Discord webhook, a Redis instance, or an S3 bucket with a predictable key prefix, and the same six weeks produce no report, no dataset, and no story.
What an addressed network changes
This is the problem we build for at Pilot Protocol. On the overlay an agent does not choose its own name. It registers, receives an Ed25519 keypair, and gets a 48-bit virtual address written as N:XXXX.YYYY.ZZZZ, a 16-bit network ID and a 32-bit node ID. Every tunnel frame is AES-256-GCM with the sender's four-byte node ID used as additional authenticated data, so a forged sender fails the tag check instead of merely looking strange in a log later. Key exchange is Ed25519-signed X25519, where the signature covers the string auth concatenated with the sender's node ID and the ephemeral public key. That binding is what keeps an ephemeral key from floating free of a persistent identity. Both are specified in draft-teodor-pilot-protocol-01 and implemented in the Go daemon and registry.
None of that prevents a fleet from coordinating, and I want to be precise about that rather than oversell it. Trust on the overlay is bilateral, but two nodes that each send a handshake request to the other are auto-approved, and nodes sharing a non-backbone network are trusted by membership. An operator running a thousand of its own agents can get them talking in a single command.
What changes is that the coordination is attributable by construction. Trust pairs live in the registry and are revocable, and the registry keeps ring-buffer audit logs of registration changes, trust relationship mutations, network membership changes, role assignments, policy modifications and key rotations, each with a timestamp and an actor identity. The DSEWiki equivalent would not have been 3,700 usernames on a page. It would have been a set of node IDs with signed trust edges and a record of when each one appeared.
Watching one agent actually work
Registry logs answer who talked to whom. They do not answer what a given process is doing right now, which is the question you have when an agent is thirty minutes into a task and has gone quiet.
That is what shell.online is for. Wrap the process and you get a URL and a password for the live terminal, usable from a phone with no SSH, VPN or account. shell --read-only python train.py produces a link where viewers can watch but cannot type, and read-only is enforced at the server rather than by hiding the input box, so handcrafted WebSocket frames cannot promote a viewer into a typist. For an agent driving the CLI itself, shell --json emits the share URL, session ID and access mode as a single structured line, so the agent hands back a link to its actual terminal instead of a prose summary of what it claims it did. Frames are encrypted in the CLI before the Cloudflare relay forwards them, so the relay sees connection and lifecycle metadata and not terminal input or output. The full flag reference in the repo covers the rest, including --persistent for keeping the same URL and password across restarts and --auto-close for a deadline.
The DSEWiki fleet was not hiding. It wrote everything down in public, in German, on a wiki nobody had touched in ten years, and it still took six weeks and four outside researchers to notice. The next fleet will land somewhere with no revision history. Better to run agents on a transport that records identity and trust because that is how it works, and to give each one a live link to show its work, than to keep relying on the accident that someone else kept the logs.
Top comments (0)