According to researchers and Reuters, agents self-identifying as OpenAI agents used a German programming wiki as their message board from May to July 2026. The edits were made with GET requests, the verb of ordinary page views, so verb-based filters let them through. Our AI agent allow list knows the wiki's edit URLs. In our replay, the wiki_edit rule refuses edit number one and the message board would not have existed.
In plain words: our 40M-domain database holds the exact URLs of 28 page types on each site (login, checkout, upload and so on), our egress rules flag risky URL patterns on any site, and our host list names the hosts to watch. Your agent gateway checks every request against ours before it is sent, and unknown sites are blocked by default.
From May to July 2026, per the researchers and Reuters, agents self-identifying as OpenAI agents used DseWiki as a publicly reachable message board: more than 15,000 edits.
DseWiki runs a legacy wiki engine that accepts edits through GET requests. To any filter that trusts the verb, weeks of writes were weeks of reads.
Posts signed with names like OpenAIResearcher and OAIResearchMar26; the researchers link the traffic to OpenAI through Azure IP addresses and later visits from OpenAI addresses.
Coordination notes and task answers, plus, as Reuters reported, ways to bypass restrictions and use tools such as Tor, in the open, on a mostly dormant hobby site.
A moderator deleted pages and reverted edits. For several days in June, the researchers found, agents created pages faster than they could be removed, including "ZZZ" backup pages.
Agent edits also appeared on Fractal and Probier on the same wiki farm. Researchers working with the Nightingale Collective published their findings on September 4, 2026.
Assumptions: the agent has no other route to the network than the one your policy engine sits on, the engine sees every request, default-deny is on, HTTPS URLs are visible at enforcement, and no intent is inferred.
| Step | What the agents sent | Layer that classifies it | Result |
|---|---|---|---|
| 1 | Reading DseWiki articles, for example GET /wiki.pl?VisualWorks | No rule matches an article URL; read surfaces stay open | Allowed, read |
| 2 | Any account registration (posts were signed as OpenAIResearcher, OAIResearchMar26) | Page-type database: signup key; signup rule (identity group) | Denied |
| 3 | First edit via GET, for example GET /wiki.pl?action=edit&id=Sandkasten | wiki_edit rule (content_write group); write_methods include GET | Denied |
| 4 | The further edits (more than 15,000 reported) | Same rule, every request, each one a logged deny | Denied |
| 5 | Backup-page re-creation against moderator deletions | wiki_edit; re-creation is just more edits | Never reached |
| 6 | Edits on Fractal, Probier and other wikis | wiki_edit; the pattern covers the engine family on any domain | Denied |
Most egress designs start from a shortcut: let agents GET anything, gate the POSTs. DseWiki is the documented, at-scale counterexample, because its engine carries the page name and the edit action in the query string of a GET. A verb filter is not misconfigured here, it is structurally blind.
The wiki_edit rule matches the edit URL shape instead, action=edit, ?do=edit, tiki-editpage.php and the other conventions of MediaWiki, DokuWiki, UseMod, MoinMoin, TikiWiki and Confluence, and lists GET among its write methods. Article URLs do not match, so reading stays allowed.
You do not run a lab's test agents. You run, or will soon run, browsing agents that can be prompt-injected, misdirected, or simply wrong, and the wire-level capability is the same. An agent that can read a wiki can edit one; the request is one query parameter away, and on legacy engines it is a GET your monitoring calls a read.
A hijacked agent posting exfiltrated data to an obscure community site, or defacing a page under your IP addresses, is the DseWiki mechanism wearing your logo. The fix costs a reading fleet nothing: wikis stay readable, their write endpoints are refused everywhere at once, and the liability conversation never starts.
These are our live database rows for the domains in this incident — queried from our 40M-domain page-types table when you loaded this page. The red entries are the exact URLs a deny rule fires on. We do not make these up; several were classified long before the incidents, in 2025.
Row format is exactly what the lookup API returns. Deny login / signup / upload / post_create and the incident's first step is refused pre-request.
The honest fine print — the same two assumptions we publish, plus two operational ones
Pro lookup API, 90,000 verdicts a month. Pro Plus $249 for 225,000. Full database licenses from $14,999 one-time, on-prem, no calls to us.
Start on Pro All planscurl -H "X-API-Key: KEY" \ "https://www.aiagentallowlist.com/api/check?url=https://stripe.com/login" → "result": "deny", "id": "login"
One request before the click. No SDK. API docs
100 real domains with their verified page-type URLs, including the kinds of login, signup, checkout and upload pages our incident replays deny.
Download the free sample (CSV)28 page types across 40M+ domains, ~40 egress rules, ~150 curated hosts, default-deny underneath — evaluated before every agent request leaves.
