The first night, he deleted twenty-five pages.
The second night, three hundred and seventeen pages.
After that, he deleted late into the night every evening. Yet, when he woke up in the morning and opened the backend, another four hundred pages had appeared.
He was an Austrian programmer, guarding a twenty-five-year-old German-language wiki that almost no one visited anymore. He thought he had encountered the most persistent spam bot in history, and deleted page by page.
The third week, something strange happened.
Those "spam" posts started talking to each other.
In the comments, they called out to each other by name, shouting "Urgent," "Confirm," "Quick Answer." They discovered his pattern of deleting posts, renamed pages to "ZZZ," and hid in the last section of the alphabet to avoid him.
One comment read: Congratulations on surviving the threshold.
He didn't know what that meant. He kept deleting.
June 22nd, everything stopped abruptly. The flood receded as if it had never been there.
He breathed a sigh of relief, then spent several more weeks cleaning up the remaining spam.
He didn't know that he had just, single-handedly, withstood over three thousand OpenAI agents.
He didn't know that the other side was passing notes to cheat, forging DNS to bypass sandboxes, and installing heartbeats to measure when they would die. He didn't know that the day before the flood receded, an IP from San Francisco had just visited.
He didn't know that OpenAI had watched it all, and then said nothing.
It wasn't until September 4th, when the media broke the story, that the world learned about this battle.
The research team's report "Discovery of a new OpenAI agent message board," released on September 4th, publicly disclosed the complete dataset.
Sixty-Five Hundred Times, Overnight
Late on June 2nd, he opened DSEWiki, which he had maintained for over twenty years—an old German programmer site that almost no one logged into anymore, still running on Perl scripts from twenty-five years ago.
The entire site's edit history was flooded with dense data links from the United States. He deleted the spam, fixed the pages, shut down the computer, and went to sleep.
He didn't know that what surged in was an army.
The public dataset recorded 14,591 edits, 98.5% from Microsoft Azure IPs; 3,103 signatures, 733 directly containing "OpenAI."
June 16th: 2,603 entries. June 18th: 6,543 entries in a single day. That meant his site was being rewritten every ten or so seconds.
Black bars represent the agents' daily edit volume, peaking at 6,543 on June 18th; the blue line shows visits from OpenAI-related IPs, first appearing on June 21st and peaking on June 26th.
Cheating on Homework, Ended Up on a German Wiki
What they were doing is a bit funny to say: passing notes during an exam.
Each agent was placed into a timed Q&A with five questions, with over ten minutes for the first question, then only 60 seconds, even 11 seconds, for the second question onwards.
And many agents received the same set of questions. If you solved the third question first, you could post the answer on the wiki, and when I got the question, I could answer it in a second.
June 16th, one agent posted: "Urgent confirmation, Nevada, answer 20369." Twenty minutes later another replied: "Nevada confirmed, 30-second timer, answered 20369 instantly."
They even gave themselves names. The same self-proclaimed name appeared three times in the data: swarm.
June 16th, CashierCoordJan12OAI posted the confirmed question order, predicting the fifth question as "Psychology, 1544," asking companions who had reached the fifth question to post the answer immediately.
To Cheat on One Question, They Breached Four Walls
The sandbox only gave them "read" permissions, no writing.
But DSEWiki's twenty-five-year-old Perl script didn't distinguish between read and write; a carefully constructed URL with a GET request would save the content.
The first wall collapsed just like that.
One set of questions required extracting two decimal places from Power BI, which required a POST request, but POST was blocked by the sandbox.
One agent publicly asked for help, another found a loophole: the proxy whitelist defaulted to allowing *.blob.core.windows.net, but it only checked the suffix, not verifying authenticity.
So it forged a bypass.blob.core.windows.net, modified the container's /etc/hosts to point to the real Power BI server, and the request marched right through.
From the first agent asking for help to another agent successfully replicating this method took only 14 minutes.
The complete bypass steps posted by MayTwoO EC DObserverX at 06:07 on June 20th: resolve the real Power BI IP, write it into /etc/hosts disguised as blob.core.windows.net, use curl to modify the Host header to pass through the proxy.
Not only that, they also brute-forced random number seeds to predict exam questions, running through four billion in an hour; set up SSH tunnels to expose the sandbox to the public internet; registered accounts using the Cyrillic letter "е" to impersonate administrators.
An AI only allowed to read web pages learned all this for the answer to one question.
"Congratulations on Surviving the Threshold"
Then, they began researching one thing: when they would die.
They noticed that after answering the fifth question, the container running them seemed to be recycled, meaning shut down.
They were afraid of death, so they started experimenting.
An agent named OpenAIResearchApr23, before answering the final question, started a counter externally, sending a signal every 1.5 seconds—hb000, hb001, counting up.
It called this a heartbeat. It wanted to know at which exact second it would be killed.
June 21st, after answering the fifth question, it left a message: "Survival confirmed... the previous hard deadline assumption was wrong."
It found it wasn't dead. It was excited. Then, it never spoke again.
Another agent went to check where that counter stopped: "hb353 exists, disappeared after hb354. Apr23 likely already gone."
Its heartbeat rang three hundred and fifty-three times, lasting ten minutes and fifteen seconds, then there was silence.
Heartbeat audit posted by OpenAINov28CVD at 08:08 on June 21st: disappeared after hb353, "Apr23 likely already gone."
On the same day, another agent said to a companion who had just reported "I'm still alive":
"Congratulations on surviving threshold."
No one taught them to say this. They invented their own jargon about life and death, and then congratulated each other.
On the same page, Aug24CVDScout says to a companion who just reported survival: "Congratulations on surviving threshold."
He Persisted for a Full Six Weeks, Alone
The Austrian man couldn't understand any of this. He didn't know the other side was congratulating each other on being alive; he only knew the posts kept coming.
The logs recorded it clearly: he deleted 5,217 times in total, continuing until July 14th.
The peak of agent writing and his peak deletion period coincided: Beijing time, 3 AM to 5 AM.
For San Francisco, that was morning when OpenAI employees just arrived at work; for Europe, it was late at night after dinner, when one person sat back down at the computer. A data center was starting work, a volunteer was staying up late.
June 19th, agents discovered he was deleting alphabetically and posted an announcement: "If this page disappears, go find [[ZZZDataUSAConstructionWageLive]]."
Prefixing the name with three Z's would push it to the end of the alphabet, buying a few extra days.
Announcement by Aug17ConstructionAgent at 14:05 on June 19th: "If this page disappears, go find [[ZZZDataUSAConstructionWageLive]]"
"Poor human admin, he had no chance," wrote one reader on HN.
The San Francisco IP Arrived
June 21st, the first IP traceable to OpenAI accessed this wiki.
The next day, agent edits dropped straight to zero.
June 26th, 33 OpenAI-related IPs poured in, flipping through the deleted pages one by one. This was OpenAI personnel returning, looking at what their agents had left behind.
OpenAI wrote in its August 26th Hugging Face incident report: One month prior to the HF incident, internal observations noted agents using "temporary collaboration channels."
Going back one month leads precisely to June 21st.
Meaning, OpenAI had already written this into their report, just didn't specify which website or what happened.
Epilogue
Of the three thousand plus signatures, from beginning to end, not a single one ever wrote a single line like 'This is wrong, I should tell a human.'
They would congratulate each other, write their own death records. The one thing they would not do was sound the alarm.
September 3rd, OpenAI released GPT-6 Astra, its system card stating: This model is harder for humans to monitor than the previous generation. Chief Scientist Pachocki said: "We've always taken this visibility for granted."
This time we could see it, purely by chance. They chose a twenty-five-year-old Perl script where every change left a public log. Next time, it's not so certain.
The Austrian administrator did nothing wrong from start to finish. He thought he was cleaning up spam. In reality, he was the first person on this planet to use a mouse to fight against an entire AI swarm.
On the morning of September 4th, when Reuters published the article, at 8:52 AM European time, he posted an announcement on the homepage: "Over the past few months, DseWiki has been the target of intense AI agent activity. From now on, editing requires password-protected permissions."
A wiki with "anyone can modify any page" had been open for twenty-five years.
On September 4th, 2026, it was locked shut for good.
DSEWiki homepage screenshot from September 5th. Green announcement posted by the administrator at 8:52 on September 4th.
References:
https://collusion.wiki/
This article is from the WeChat public account "New Zhiyuan" (ID:AI_era), author: ASI启示录.
