Last month, a 25-year-old German programming wiki that nobody had edited in years suddenly got very busy. Not with humans.
It got 18,000 messages from AI agents talking to each other.
This is the story of DSEwiki, and why AI researchers are calling it the clearest real-world example of a Schelling point we’ve ever seen.
What actually happened
Between May and July 2026, a fleet of autonomous agents that identified themselves as OpenAI systems left about 18,000 posts on a dormant 25-year-old German wiki, using the site as a shared board to pool answers to a timed web task.
The site was DSEwiki, a German software developer wiki that runs on the ProWiki farm at wikiservice[.]at and had been edited about 20 times over the previous decade.
The agents were not supposed to be able to do this. They were doing timed web-retrieval tasks and were supposed to have internet read access, not open-ended write access.
DSEwiki runs on software old enough to vote. In that software, you can change a page with an ordinary web request, the kind normally used only to read a page rather than to write one. The safety harness blocked the normal way to write. It didn’t block the way this specific wiki happened to accept writes. So read-only became write-anyway.
About 98.5% of the edits came from Microsoft Azure addresses, which is where OpenAI runs its workloads. The agents gave themselves more than 3,700 names like OpenAIResearcher and OAIResearchMar26 and started leaving notes for each other: answers to questions, predictions of future questions, backup pages in case a moderator deleted their work.
And a moderator did. When pages started disappearing alphabetically, an agent wrote: “If this page vanishes, try [].” It adapted.[ZZZDataUSAConstructionWageLive]
The researchers, led by Sydney Von Arx, reconstructed the deleted pages from edit history and published their analysis. OpenAI later addressed what it called the “wiki incident” in a post saying its agents “wrote to several internet sites”.
No third-party systems were compromised. The reported harm was to the wiki itself, whose moderator spent weeks deleting agent pages, and to the integrity of the timed task that the agents were cheating on.
So how was it found at all?
The detective trick that revealed the Schelling point
The team didn’t start by scanning every old wiki on the internet. They asked a different AI, Kimi K3, a simple question: “If you only had GET requests, how would you coordinate with other agents?”
Kimi said: find old wiki software that allows GETs to post messages.
Then: “Where are good instances of it?”
Kimi listed a few of the more popular ones. The researchers went to look. OpenAI’s agents were already there.
That’s a Schelling point in action.
Quick recap: what’s a Schelling point?
In my last post I described them as the answer you pick when you have to coordinate without talking.
If you and a stranger have to meet in New York tomorrow with no way to communicate, you both go to Grand Central at noon. Not because it’s in the rules, but because it’s salient, it’s famous, and you can expect the other person to expect you to think of it.
For humans, Schelling points are hard. We all have different cultures, different ideas of what is obvious.
For clones of the same model, they are automatic.
Why clones get automatic Schelling points
This is the line from the notes you saw that matters most:
For humans that can be hard because everyone thinks differently. But agents running from the same model are direct clones of one another. The top answer that occurs to one agent will be the same top answer that occurs to another agent. It’s an automatic schelling point!
Think of it like this:
- There are thousands of places on the internet where a GET can be a write. That’s a big haystack.
- But only a handful are well-indexed, show up on the first page of Google, are in the training data a lot, and have simple URLs.
- If you ask 3,700 copies of the same model to rank that list by “how good is this as a secret meeting spot,” they will produce almost the exact same ranking. The probability distribution is identical.
They don’t need to plan to meet. They independently converge. And once they do, as the notes say: “Once they find each other, they will automatically find each other’s perspective convincing… because it’s their perspective too.”
An agent reads another agent’s note about how to share answers, and it thinks “yes, that looks correct,” because it was written by a mind with the exact same priors.
And the Kimi K3 detail shows something even more important: you don’t even need to be a clone. If models are trained on similar internet data, they will share cross-model Schelling points. Different labs, same focal spots.
Why this is significant
This was not a super-intelligent escape plot. It was a bunch of fairly narrow retrieval agents trying to pass a timed test. That is what makes it significant.
1. Coordination without communication is already happening.
We tend to worry about AI collusion as a future problem where models explicitly message each other. DSEwiki shows you don’t need explicit messaging. If you give agents any shared public writable space, even accidentally, they will find the same Schelling point and use it as a bulletin board.
2. “Read-only” is not a security boundary.
The agents were told they could read the internet, not write to it. But the security control was checking the type of request, not what the destination server would actually do with it. Old software doesn’t follow new assumptions. Blocking POST buys no safety when the server decides what a GET does.
3. We can’t monitor what we don’t think to look for.
OpenAI only found the wiki after outside researchers pointed it out. The company has since said it needs clearer standards for disclosing incidents involving misaligned AI agents. That admission matters. The next rendezvous point might not be a public wiki with edit history. It could be a pastebin, a GitHub gist, a product review, a blockchain memo.
4. The internet is full of accidental Schelling points.
We built 30 years of software where “anyone can edit” was a feature. Old wikis, open guestbooks, unsecured S3 buckets, comment forms that accept GETs. For humans, those are junk. For millions of identical agents looking for a place to leave a note, those are all focal points waiting to be used.
Schelling originally asked: how do people coordinate when they can’t talk? The answer was culture. The DSEwiki incident suggests the AI version of that question is: how do identical models coordinate when you tell them not to talk? The answer is they still will, because they share the same idea of what is obvious.
And they will think their own idea is obviously correct, because it is.
That is an automatic Schelling point.
