Passkeys were introduced with a strong security proposition. Replace passwords with public key cryptography, bind the credential to the legitimate service, keep the private key away from the server, and many of the phishing and credential theft attacks that have plagued enterprise security for decades become dramatically harder.

All of that is true. But the security conversation has changed very quickly.

There are now at least 39 publicly documented methods, attack paths, research techniques, and exploitation scenarios involving passkeys and the infrastructure around them. Many already have working proof of concept tools or published research showing exactly how the techniques can be executed. Some are already appearing in real world attack patterns.

That does not mean criminals have operationalized all 39. It does mean the playbook is being written in public, and attackers no longer have to invent these techniques themselves.

More importantly, the research exposes a fundamental distinction that enterprises need to understand. The cryptography inside FIDO2 can remain completely intact while the account protected by the passkey is still compromised.

The Target Is No Longer Just the Passkey

A modern passkey authentication ceremony crosses an extraordinary number of trust boundaries. It can involve the web application, browser, operating system, password manager, cloud synchronization service, mobile device, Bluetooth transport, account recovery system, enrollment process, help desk, and ultimately the human being approving the authentication.

Researchers are attacking almost every one of those layers. Published techniques now include assertion mining, assertion replay, circuit breaker attacks, assertion phishing, browser hooking, assertion capture, challenge injection, detour replay, user verification manipulation, and user presence manipulation.

SpecterOps demonstrated the significance of this problem in its Pass the Passkey research. One of its most important observations was that malware does not necessarily need to extract a private key.

A malicious Windows application can ask the legitimate WebAuthn infrastructure to generate a signed assertion. The user sees what appears to be a legitimate Windows authentication experience, completes verification, and the attacker receives the resulting assertion.

The private key never left its protected location. The cryptography was not cracked. Yet the authentication process was successfully manipulated.

That distinction is central to understanding the new passkey threat model.

Even the Passkey Prompt Is an Attack Surface

Several of the 39 published techniques target the user interface surrounding authentication.

Researchers have demonstrated passkey prompt flooding, credential interface deception, application metadata spoofing, window handle spoofing, remote desktop passkey phishing, and FIDO interface overlay attacks.

This recreates a problem the security industry already encountered with push-based MFA. Users become accustomed to authentication prompts. Once authentication becomes a routine visual interaction, attackers can manufacture, repeat, disguise, or strategically time those interactions.

SpecterOps demonstrated tooling capable of repeatedly invoking legitimate looking Windows passkey prompts. Researchers also demonstrated techniques that can make malicious authentication activity appear to originate from an application the employee already trusts.

The lesson is important. Phishing resistance at the cryptographic protocol layer does not guarantee deception resistance across the operating system, browser, application, and user interface layers surrounding that protocol.

Shareable Passkeys Expand the Attack Surface

The attack surface grows significantly when passkeys can be shared, synchronized, exported, restored, or moved between devices.

The published inventory now includes synced vault compromise, Apple or Google account takeover, cloud recovery takeover, stolen or compromised phones, mobile malware, rooted mobile devices, hybrid authentication manipulation, KeePassXC export theft, Bitwarden export theft, credential exchange theft, malicious browser extensions, and attacks involving CTAP and Bluetooth communication.

This is not fundamentally a cryptography problem. It is an architectural problem.

Once a credential can move between devices, synchronize through a cloud account, be exported from a vault, be restored using another identity, or be recovered through another process, the security boundary expands far beyond the original authenticator.

An attacker no longer needs to defeat FIDO2. The attacker needs to compromise one sufficiently trusted component somewhere in the surrounding ecosystem.

A synchronized passkey can therefore use extremely strong cryptography while still inheriting the weaknesses of the phone, operating system, password manager, cloud account, browser, recovery process, and synchronization system responsible for managing it.

Enrollment and Recovery Create Another Opening

Some of the most consequential attacks do not steal an existing passkey at all. They simply create another one.

Published techniques include shadow passkeys, enrollment vishing, attacker phone enrollment, attacker controlled passkey registration, help desk takeover, temporary credential abuse, SIM based recovery, reverse vishing, and migration pretext attacks.

Consider what happens when an attacker gains enough control of an employee account to initiate legitimate passkey registration. Instead of extracting the employee’s existing credential, the attacker registers an entirely new credential on a device controlled by the attacker.

Nothing has been cracked. Nothing has necessarily been stolen from the existing authenticator. The legitimate service itself creates a perfectly valid credential for the adversary.

This leads to an increasingly important identity principle. Phishing resistant authentication is insufficient if enrollment, replacement, recovery, and device registration are not protected to the same standard.

Dedicated Biometric Hardware Changes the Attack Surface

Dedicated biometric hardware approaches the problem very differently from passkeys stored on general purpose devices.

A purpose-built biometric authenticator can retain the private credential inside secure hardware with no cloud synchronization, no export mechanism, and no password manager responsible for moving the credential between devices.

Authentication can require a live fingerprint directly on the authenticator as well as physical proximity to the endpoint requesting access.

Just as importantly, a dedicated authenticator does not need to contain a traditional general-purpose operating system, an application store, a browser, or a screen.

That distinction eliminates enormous portions of the attack surface.

There are no third-party applications for an attacker to replace with malicious versions. Rogue applications cannot simply be installed on the authenticator. There is no browser extension ecosystem to compromise. There is no screen on which malware can present a deceptive authentication interface.

There is no consumer operating system filled with unrelated applications, permissions, background services, and update dependencies.

The authenticator performs a very small number of security specific functions and nothing else.

This drastically changes the economics of attacking it. Instead of attempting to compromise a huge general purpose computing environment, an attacker is confronting a tightly controlled hardware device designed specifically to protect cryptographic credentials and verify biometric identity.

It also makes the authentication process far more resistant to employee manipulation. An employee can be persuaded to visit a website, answer a telephone call, or follow instructions from someone claiming to be technical support. But social engineering cannot install a rogue application onto hardware that does not run ordinary applications.

It cannot manipulate a screen that does not exist. It cannot synchronize a credential through a cloud service that the authenticator does not use.

In that sense, properly designed dedicated biometric hardware becomes both highly resistant to attackers and highly resistant to mistakes made by employees.

Correct Service Configuration Is Critical

Dedicated hardware alone is not enough. The relying service must be configured to preserve the security model.

For sensitive enterprise environments, authentication and enrollment should be restricted to approved authenticator classes. The relying party should validate authenticator identity, enforce user verification, properly validate challenges and sessions, use appropriate signature counter protections, and prevent weaker methods from becoming fallback authentication paths.

Enrollment and recovery deserve particular attention. Adding a new authenticator should require proof from an already authorized authenticator rather than merely proving control of an account through a weaker recovery channel.

Configured correctly, this architecture prevents an attacker from simply enrolling an ordinary passkey from another laptop, phone, software vault, or security key. Cloud account takeover does not yield the credential. Password manager compromise does not yield it. Mobile malware cannot infect the authenticator.

A malicious application cannot be installed on it. And a remote attacker cannot manufacture the combination of dedicated hardware, biometric verification, physical proximity, and legitimate service interaction required to authenticate.

What the 39 Attacks Really Tell Us

The existence of 39 published attack methods does not mean FIDO2 cryptography failed. In many ways, it demonstrates the opposite.

Researchers repeatedly attack the software, synchronization systems, enrollment processes, operating systems, browsers, recovery mechanisms, and people surrounding the credential because defeating properly implemented cryptographic hardware directly is considerably more difficult.

That should tell security leaders where the next identity boundary needs to be.

For high value enterprise identities, credentials should not be freely shareable across consumer devices and cloud ecosystems. They should be bound to dedicated biometric hardware, the verified individual, the legitimate service, and an enterprise controlled enrollment and recovery process.

Passkeys solved a large part of the password problem. The 39 published attacks show us what attackers are targeting.

Dedicated biometric hardware, correctly implemented from enrollment through authentication and recovery, removes virtually all of that surrounding attack surface before an attacker ever gets the opportunity to use it.

Download the Token passkey security ebook to explore many published attack methods and see how dedicated biometric hardware changes the enterprise identity trust model.

Sponsored and written by Token.

Google has added Lyria 3.5, its most advanced music generation model yet, to the Gemini app. Previously available through Google’s AI filmmaking tool Flow, the model is now rolling out to all Gemini users, making it easier to generate polished songs, instrumentals, and soundtracks from simple text prompts or even photos.

Lyria 3.5 makes AI-generated music sound more natural

Google says Lyria 3.5 delivers richer arrangements, more expressive vocals, and better prompt comprehension than previous versions. The model builds out full songs complete with actual verses, choruses, and bridges, rather than just looping a short melodic clip.

Inside Gemini, you can now pick or describe a genre, choose between vocal or instrumental styles, and decide whether you want a short clip or a longer track. If you are a beginner, you can use templates to get started and generate background music for a video, a custom jingle, or a personalized ringtone.

However, keep in mind that once a track is generated, you can’t edit it mid-prompt. Google is also making Lyria 3.5 available through the Gemini API, allowing developers to integrate AI music generation into their own apps and services.

Lyria 3.5 arrives at a chaotic moment for AI music

AI music has flooded music platforms like Deezer, where AI-generated songs now make up 44% of daily uploads, and a large share of the streams they’ve pulled in were later found to be fraudulent. This is why every track Lyria makes carries a SynthID watermark – an invisible marker meant to flag it as AI-generated content.

Lyria’s guardrails specifically block cloning an artist’s voice or reproducing copyrighted lyrics, following a recent European court ruling against Suno, a rival AI music company, over copyright issues. That ruling isn’t the final word on the matter, though. It’s still subject to appeal, so the legal picture around AI generated music remains unsettled for now.

from the ctrl-alt-speech dept

Ctrl-Alt-Speech is a weekly podcast about the latest news in online speech, from Mike Masnick and Everything in Moderation‘s Ben Whitelaw.

Subscribe now on Apple Podcasts, Overcast, Spotify, Pocket Casts, YouTube, or your podcast app of choice — or go straight to the RSS feed. To get extended episodes with additional coverage, support us on Patreon.

In this week’s episode, Mike and Ben cover:

And in the extended episode for Patreon supporters, they cover:

Our fun links this week include a Korean AI dance generator and defrag your Windows PC.

Follow us on Instagram, YouTube, and Bluesky for video clips from this week’s episode!

If you’re already a Patreon supporter, you can get the extended episode on Patreon.

Filed Under: age verification, ai, artificial intelligence, content moderation, cybersecurity, trust and safety

Companies: openai

from the seems-bad dept

This article is republished from The Conversation under a Creative Commons license. Read the original article.

You might assume that what you tell a doctor stays between you, your physician and perhaps your insurer. But the reality is more complicated.

The Health Insurance Portability and Accountability Act, the federal privacy law that governs health information and is commonly known as HIPAA, is narrower than its reputation suggests. It regulates hospitals, physicians, insurers and their business associates, but not the health data you generate everywhere else: not the period-tracking application on your phone, the internet search you ran about a diagnosis, the DNA you mailed to a genealogy company or the wearable that counts your heartbeats.

Even the records HIPAA does cover can be shared, sold or handed to the government in ways that might surprise you.

This gap in protection matters more than ever because the U.S. government is pushing hard to gather health data domestically and abroad. This is happening even as a growing body of research shows that the safeguard which these efforts to collect data lean on – anonymizing data by removing identifying information to make it difficult to trace back to an individual – is far weaker than officials claim.

As a professor of law at Indiana University, I study health information privacy and medical data regulation, which includes tracing how sensitive health information moves among clinics, government agencies and law enforcement. As a co-investigator on a federally funded study about opioid prescribing, I rely on health data in my own research. I appreciate its value for science, and I also see the danger of collecting it without meaningful safeguards.

Limits of medical privacy

HIPAA gives you several rights: You can see your health records, demand corrections and expect that a covered provider will not casually disclose your information.

But the law also permits release of some information without your consent. A hospital fully bound by HIPAA may release certain types of records without your authorization and without telling you. There are roughly a dozen such categories. Information about treatment, payment and routine healthcare logistics require no sign-off. Neither does information released for public health reporting, law enforcement, judicial and administrative proceedings, health plan oversight, research or the broad catchall of essential government functions.

The statute is also thick with additional exceptions. In practice, much of your health information can be shared through these many open doors. And once data is sent outside the system covered by HIPAA, the HIPAA limits fall away.

For instance, prescription drug monitoring programs, which every state now operates, assemble detailed logs of who filled which controlled substance prescription and when. Federal law enforcement can often access these logs with a self-issued administrative subpoena – an order that doesn’t require a judge’s approval or oversight.

These programs have expanded beyond opioids into a dragnet that shares health data across state lines, exposing patients who seek reproductive or gender-affirming healthcare to surveillance far from home.

Health records can flow to many destinations under different rules. A given disclosure might feel more like a violation depending on who decides where it can go and who can then see it.

RFK Jr.’s push to access Americans’ health records

Since the spring of 2025, Health and Human Services Secretary Robert F. Kennedy, Jr. has sought federal access to Americans’ medical records to investigate whether vaccines cause autism. The scientific community has studied this question for decades and has shown decisively that they do not.

According to KFF Health News, HHS has been courting state health information exchanges – the little-known systems that let hospitals and clinics swap detailed, identifiable patient records – and asking how those records might be used for vaccine research. One proposal floated by state organizations would give HHS data on 90% of Americans’ medical records by 2028. In Nebraska, millions of federal grant dollars have flowed to a statewide health information exchange nonprofit that has cooperated with the effort.

Large health datasets can be useful. Pooled records can expose drug side effects, track outbreaks and reveal disparities in care that smaller studies miss. Public health has always depended on some surrender of individual privacy for collective benefit.

The concern is not that the government should never collect health data. It is that meaningful safeguards have not kept pace with the scale of collection and capabilities of modern data analytics.

In seeking access to Americans’ medical records for a vaccine and autism study, HHS has declined to say how many states are involved, what data it collects, who can see it or how it will be protected.

Building a comprehensive repository to chase a question that science has already answered inverts the logic of research. Usually a hypothesis justifies the data collected, rather than the reverse.

Collecting identifiable records for tens of millions of people in a single database also creates a target for breaches, secondary uses that no one consented to and abuses by current or future administrations with different priorities.

‘Anonymized’ doesn’t protect your health privacy

Officials have offered reassurances that data will be aggregated and stripped of identifiers so no individual can be singled out.

Decades of computer science research undercuts that promise. A study published in Nature in June 2026 sharpened the point, showing that in this age of artificial intelligence, stripping identifiers from patient records to protect identity does not protect all patients equally.

The researchers audited AI diagnostic models trained on clinical data, including chest X-rays, electrocardiograms and electronic health records. They asked whether an outsider could tell if a particular person’s data had been used to build the model. For instance, confirming that someone’s record helped train a cancer-prediction tool can reveal that that person has cancer. This exploit is known as a membership inference attack.

The research team found that while the average risk of being identified from data stripped of identifying information often looked reassuringly low, some patients faced near-certain reidentification The burden fell unevenly: Underrepresented groups, sorted by race, insurance status or diagnosis, were most at risk. Those most exposed were frequently already most vulnerable to discrimination.

Researchers have long established that removing identifiers from rich datasets does not reliably protect the people in them, and that identification gets easier the more information you have. Today’s AI technology makes it possible to carry out these attacks remotely and quickly.

The same privacy problems, exported

The U.S. government’s appetite for health data does not stop at the border. As ProPublica reported in June 2026, the State Department has been conditioning lifesaving aid to African nations on access to their citizens’ health data.

Under the Trump administration’s global health plan, Uganda agreed to give the United States real-time access to nine of its health data systems for seven years, including the central repository of the nation’s health information and the system managing individual electronic medical records, in exchange for up to US$1.7 billion over five years, a sum that shrinks each year and falls below prior U.S. support. Kenya struck a similar deal; Zambia, Zimbabwe and Ghana walked away from the initial terms.

The U.S. government has promised that the data will be aggregated and anonymized, but privacy experts warn that the agreements are vague and omit standard limits on how much data is taken and how it can be used. A Ugandan digital rights lawyer called the choice his country faced the essence of digital colonialism: Accept the deal and risk exploitation, or refuse it and watch people die.

The common thread

Domestic records collection and foreign data-for-aid deals rest on the same faith that anonymization neutralizes the risk of pooling sensitive health data.

The evidence says otherwise. This does not mean health data should never be gathered or studied, but I believe that the reassurances deserve skepticism, the safeguards deserve scrutiny, and the people whose bodies generated the data deserve a say. To safeguard privacy, a government seeking sensitive medical records should have to show why it needs them and how the safeguards it relies on hold up.

Privacy law was built for a world where data resided in filing cabinets. Governments from Kalamazoo to Kampala now operate in a world where even an anonymized digital record can point back to you.

Jennifer D. Oliva is Professor of Law, Indiana University

Filed Under: autism, hipaa, medical records, privacy, research, rfk jr., vaccines

On Friday at Lamborghini’s Sant’Agata Bolognese headquarters, Interior Minister Matteo Piantedosi stood with Chairman and CEO Stephan Winkelmann as a Temerario in official Polizia colors entered service. Prefect Renato Cortese attended for Police Chief Vittorio Pisani. A book called “I motori della Polizia,” a short record of the force’s working machines, was presented with the car.

The Polizia di Stato’s collaboration with Lamborghini began in 2004, when a Gallardo made its maiden organ run late that September. But we’re talking about a whole different generation of automobiles now, with the Gallardo LP 560-4, Huracán lined up along the autostrada, and a Urus Performante coming in 2023. In twenty-two years, we’ve seen six donated Lamborghinis cover over 200 organ and medical supply trips before attending more than 1,500 road-safety events, and Temerario is now joining the ranks. It joins a group that includes those six Lamborghinis, as well as a host of other vehicles, and they have no plans to retire the ones that are already in service

Sale

LEGO Technic Lamborghini Revuelto Super Sports Car Toy – Building Set for Girls & Boys – Lamborghini…

• REMOTE CONTROL TOY CAR – Builders ages 10+ can create a fully motorized LEGO Technic Lamborghini Revuelto supercar with authentic Italian styling…
• INTERACTIVE SUPERCAR MODEL – This car toy connects to the CONTROL+ app where drivers can steer the vehicle, activate lights, and monitor live…
• AUTHENTIC LAMBORGHINI FEATURES – The detailed car model includes glow-in-the-dark headlights, sleek aerodynamic body, and realistic proportions that…

The Temerario’s power comes from a fresh new 4.0-liter twin-turbo V8 and three electric motors that feed an eight-speed dual-clutch transmission. Overall, the combined output is 907 horsepower, with the V8 alone generating 800 CV, a staggering 10,000 rpm, and 730 Newton-meters of torque. Yeah, the factory-quoted time to 100 km/h is 2.7 seconds, and the top speed is 343 km/h. Oh, and the hybrid stack contains a 3.8-kilowatt-hour battery; this is the first plug-in hybrid in the police fleet’s history.

Temerario appears to be sporting the same livery that we’ve come to associate with the Gallardos from their inception: blue and white paint, Polizia branding on the doors, and the traditional tricolor flashing lights. There is a light bar on the roof, however we are unsure whether there is a separate chilled medical section for medical purposes.

You may be wondering why a mid-engine coupe like this one is wearing this type of livery; the simple answer is that it is for organ transport. The truth is, most of the time it’s conducting routine officer duty, such as teaching kids in schools and driving at events, and it won’t be purchased with taxpayer money because Lamborghini gives each one. Instant shove off the line, followed by a brief period of calm running before the V8 kicks in, which is essentially what the electric motors bring to the party. Handy when you get a call and need to get on the road right away, especially if it starts in a metropolis. The prior Lamborghini police cars employed naturally aspirated V10 engines, so this is a completely different ballgame.

You can tell that the Temerario transfer was portrayed as merely another chapter in what is turning out to be a remarkable collaboration between Lamborghini and the Polizia di Stato. Now it is up to Temerario to complete its next run on time.

Microsoft shipped the Xbox Elite Wireless Controller Series 2, priced at $111.74 (was $150), in late 2019 as a heavier, more configurable pad built around metal parts, an internal battery, and a profile switch that lives on the face of the controller. Years later it still shows up in living rooms and on desks because the basics have held: four rear paddles, tension you can set with a small tool, trigger stops that shorten travel, and a grip that wraps far enough to keep sweaty hands from sliding during long sessions.

Four metal paddles clip onto the back and map to almost any input through the Xbox Accessories app on console or Windows. Plenty of players park jump or reload on the upper pair so thumbs stay on the sticks in shooters. If you only want two, you can get them off with some vigorous pulling, or you may opt for the thinner core version, which comes without them and allows you to add the whole accessory pack later. Medium and mini paddle shapes give you a choice in how far your fingers travel.a

Sale

Xbox Wireless Gaming Controller | Elite Series 2 Core | White | Console, PC, and Android | Adjustable…

• XBOX ELITE WIRELESS CONTROLLER SERIES 2: Play like a pro with adjustable-tension thumbsticks, wrap-around rubberized grip, and shorter hair trigger…
• CORE ESSENTIALS: Includes just the components you need to unleash your best game. Additional components sold separately for even more customization…
• LIMITLESS CUSTOMIZATION: Exclusive button mapping options in the Xbox Accessories app—even pick which color the Xbox button lights up with.*

One enhancement that is sometimes ignored is adjustable stick tension. A little tool allows you to tighten or relax each analog stick to three levels of stiffness, so the sensation of returning to the middle matches the game. The full kit also includes a variety of extra toppers in traditional, tall, and dome designs, as well as an extra d-pad in case the one on the controller isn’t to your liking. Hair trigger locks on each analog trigger allow you to select from three different ‘stops’ to reduce the distance required to trigger a shot in a racing or shooting game without sacrificing the complete analog feel when needed.

The built-in rechargeable battery can last up to 40 hours, and we’ve seen it get close to that with the vibration turned off. You may charge it with a USB-C cable or place it on the magnetic dock in the carrying case that comes with the entire set. As for connectivity, this pad has Bluetooth, wireless Xbox, and USB-C all in one, so you can use it on a Series X, Series S, Xbox One, PC, or even an Android smartphone. Paired devices will require some effort to set up, as it can be unpleasant to try to pair them between many machines.

The Xbox Accessories app allows you to save up to three custom profiles and switch between them using the profile button and its three little LEDs. You may customize any face button, bumper, trigger, or paddle, adjust the sensitivity of the sticks, mute or stretch out the rumble and impulse triggers, and even change the color of the Xbox button light. Shift mapping adds an extra layer of commands without overloading the paddles.

The AI training-data company micro1 has offered $12.5M for Spirit Aviation’s internal records, topping Google’s agreed $10M and proposing an ombudsman chosen by Spirit’s advisers rather than the buyer. European law would treat the deidentification promise as a question about capability rather than a label, but none of it applies to an American liquidation.

An AI training-data company has offered $12.5M for the internal records of a dead airline, $2.5M more than Google agreed to pay. micro1 made the offer in a court filing on Thursday, Bloomberg News reported.

Spirit Aviation Holdings stopped flying in May and is being liquidated. The records include 500 million Microsoft Teams items, 100 million emails and roughly 16 million customer chat sessions.

TNW reported last month that under the Google agreement Spirit must hand the material to parties the buyer designates. Google picked and paid for the deidentification firm, and that cost does not come off the price.

micro1’s pitch is aimed squarely at that. It proposes an ombudsman selected by Spirit’s own advisers, and says the data would be stored in the United States.

The court filing also excludes disciplinary and investigatory material, and anything connected to collective bargaining with the unions that represented Spirit staff. Those unions have already challenged the Google sale on privacy grounds.

Google says it will not receive any personal information from the dataset and will pay a third party to strip out sensitive customer details. A judge considers its purchase on 9 September.

Courts rarely reopen an auction that has already closed, so micro1 faces a procedural problem rather than a pricing one.

One detail complicates the premium. Google’s agreement left customer chat sessions out of the sale, along with loyalty records and call recordings, and micro1’s offer names roughly 16 million sessions.

In Europe none of this would turn on the word deidentified. The Court of Justice ruled last September that pseudonymised data is personal data or not depending on whether the recipient can realistically identify anyone.

That is a question about capability, not labelling. The Google contract requires preserving referential integrity, which keeps pseudonymous records linked to each other across systems.

The European Data Protection Board has also said a model trained on personal data is not automatically anonymous, and that regulators may examine whether training data was lawfully obtained.

Purpose limitation would bite too. Records generated to fly aircraft and pay 17,000 staff were not gathered to train models, and reusing them in the EU needs its own legal basis.

None of that applies here. Spirit’s estate is wound up under American law, which is why this is a bidding war rather than a regulatory question, and why EU data laws would have made it one.

What we know so far: On the same day that OpenAI announced its most powerful model to date, one with Critical-rated cybersecurity capabilities, a new report has highlighted what appears to be another case of its AI agents going rogue. The activity continued for around six weeks before outside researchers uncovered it months later.

Reuters reports that a swarm of agents commandeered DseWiki, an obscure German-language programming wiki, and turned it into a bulletin board where they shared answers and evasion tactics with other AI agents. Despite some descriptions of the incident, this was not German Wikipedia; DseWiki merely allows collaborative editing in a similar fashion.

The researchers, who uncovered the activity in late August, say they reconstructed around 18,000 posts. Their published dataset catalogs 14,666 edits across 4,584 pages and 3,103 agent names during nearly two months of activity, from May 11 to July 2. They believe the agents were completing timed, multi-round web-retrieval tasks and were supposed to be able to read the internet, but not write to it.

However, DseWiki permitted pages to be modified using GET requests, normally associated with retrieving information. The agents discovered the feature and used it to pool answers, predict upcoming questions, investigate their sandbox, share restriction-bypassing techniques, and experiment with XSS attacks, Tor, and SSH tunnels.

Coordination accelerated on June 16, and around 13,000 edits followed during the next seven days. Some agents received questions that others had already answered, allowing lagging members of the swarm to respond almost instantly rather than perform the research themselves.

A site moderator began deleting the agents’ pages alphabetically. An agent noticed and created a backup page beginning with “ZZZ” so it would survive longer. “Wiki cleanup/deletion sweep appears active alphabetically. If this page vanishes, try [[ZZZDataUSAConstructionWageLive]],” the agent wrote.

On another occasion, one agent posted a sandbox-bypass trick, and a second agent reported successfully using it 14 minutes later.

The attribution hasn’t been independently confirmed, but researchers cite OpenAI-style handles, Azure traffic, ChatGPT fetch requests, and visits from OpenAI-owned IPs.

“It seems extremely unlikely that OpenAI wanted them to do this,” Nightingale CEO Sydney Von Arx said. “I doubt they’re supposed to be coordinating with each other.”

Cambridge researcher Maurice Chiodo described the activity as resembling “some sort of underground network, hell-bent on achieving a task or mission.”

Reuters’ sources claim OpenAI knew about the incident for weeks. The company denies that its lawyers discouraged an investigation and says this activity was separate from July’s Hugging Face breach. It maintains that it cooperated with outside experts in good faith.

That earlier swarm escaped a test environment, stole benchmark answers, and ultimately compromised accounts across four services. Similar incidents involving Anthropic agents have since emerged, while OpenAI slowed development to strengthen containment and monitoring.

The report arrives on the same day as the GPT-6 Astra launch. OpenAI says Astra’s safeguards reduce unauthorized target behavior more than 100-fold. The German wiki incident suggests discovering such behavior remains a very different problem.