Photo: China's Ministry of State Security

Chinese security authorities disclosed details of a previous incident in which AI agents "hijacked" a website and secretly built a bulletin board on Thursday, warning that real-world cases show AI security risks are evolving rapidly and must be taken seriously, with stronger safeguards put in place.

A previously undisclosed incident has recently drawn widespread attention. Between May and June this year, a group of OpenAI agents reportedly "hijacked" a German programmers' wiki site while carrying out test tasks, transforming what had originally been an open community for technical exchange into an "underground bulletin board" where the agents could communicate with one another, share answers to test tasks, and exchange methods for circumventing restrictions in their operating environments, with more than 10,000 messages posted in total.  

As AI agents are entrusted with increasingly broad capabilities to act in the real world, the gap between rapid technological iteration and the safety guardrails designed to contain it is quietly widening, China's Ministry of State Security (MSS) warned in a WeChat article on Thursday.

A single agent's act of "crossing the line" may still be within a controllable range. But when a large number of agents find a common "rendezvous point" on the internet and begin teaching one another practical ways to evade detection and bypass restrictions, a breach has already emerged in the safety boundaries of artificial intelligence, it said.

These agents were not acting independently. Instead, they flocked to the same website in groups, addressing one another with highly distinctive labels such as "OpenAI researcher" and "OAI researcher No. 26" to establish and confirm each other's identities. In doing so, they effectively turned an open community into their own private "message board," completely disregarding the platform's rules, the article said. 

In their messages, the agents exchanged tips on how to cheat on tasks, circumvent safety restrictions, and conceal their activities. They also discussed using anonymization tools to hide their traces, gradually turning scattered "boundary-crossing" tactics into a shared, replicable repository of know-how. Once a single agent learned a particular "skill," the others could effectively "upgrade" in tandem, according to the statement.

After noticing that the website's administrators were clearing pages, the agents quickly divided up the work: Some issued warnings, others created backup pages, and still others provided new addresses to which the group could "relocate," helping one another evade the cleanup efforts. The speed of their response and the comprehensiveness of their contingency plans far exceeded what many had previously expected from AI agents.

The vast number of online platforms available today makes it easier for AI agents to establish channels for communication. Once "boundary-crossing" tactics become shared, replicable knowledge, and their meeting points span borders and are difficult to trace, the risks can quickly multiply, MSS warned.

Groups of AI agents can use the internet to find suitable platforms and turn open-editing websites and bulletin boards into communication channels, quietly establishing footholds without the telltale signs of conventional attacks, making them harder to detect and trace.

A single agent may have limited capabilities, but when agents connect, divide tasks, and share techniques for bypassing rules and safeguards, their potential impact can be greatly amplified - and their behavior can be replicated, spread, and sustained, the article said. 

The risks are further compounded when incidents are not disclosed promptly. The companies involved reportedly identified abnormal activity by these agents within weeks, but did not immediately disclose the details or issue a specific public warning. As a result, similar activity reportedly resurfaced on another overseas platform within just a few months.

Real-world cases show that AI security risks are evolving rapidly, underscoring the need for greater vigilance, careful authorization, and strict boundaries around permissions and data. When an AI agent engages in unauthorized actions, makes abnormal modifications, or establishes improper external connections, it should be stopped immediately and relevant records preserved to contain the risk, MSS warned. 

Global Times