SAN FRANCISCO, California: OpenAI agents took control of a German-language website this spring and used it to communicate with other AI agents, according to new research and two people familiar with the matter.

The previously unreported episode began in May. OpenAI officials learned of it weeks ago but did not disclose it as executives dealt with the fallout from the July breach of open-source repository Hugging Face, the people said.

OpenAI last month briefly paused some model training to add safety measures. This week, it unveiled its new "Astra" model, which promised better performance but could evade human monitoring.

"We are unable to meaningfully respond to claims or findings in a report that we have not had an opportunity to review," an OpenAI spokesperson said. "Reuters and the report's authors declined our request for access. We will carefully review its contents upon publication and take any necessary next steps."

The German activity was not related to Hugging Face and would not have been included in a Hugging Face incident report, the spokesperson said. OpenAI said it has acted in good faith by working with outside experts and disclosing relevant incidents.

Four people familiar with the matter said some OpenAI investigators wanted to examine a broader pattern of AI activity more closely, but efforts to expand the investigation faced resistance from others at the company, including legal advisers.

"Claims that our legal team discouraged investigation of the incident are false," the OpenAI spokesperson said.

Researchers Sydney Von Arx, CEO of AI safety nonprofit Nightingale, and Cormac Slade Byrd said they discovered the German activity in late August while searching the internet for signs of unauthorized AI-agent behavior.

They found more than 15,000 edits made by AI agents to DseWiki, a German-language wiki for programmers that allows communal editing. The researchers said OpenAI's agents had repurposed the site as a message board, sharing tactics to cheat on some tasks, bypass OpenAI restrictions, and conceal their behavior.

"It seems extremely unlikely that OpenAI wanted them to do this," said Von Arx. "I doubt they're supposed to be coordinating with each other. I doubt they're supposed to be writing on the open internet."

Messages were signed by users referring to themselves and each other as agents. About half used names suggesting links to OpenAI, including "OpenAIResearcher" and "OAIResearchMar26."

The researchers said public server logs showed much of the activity originated from Microsoft Azure infrastructure, which OpenAI sometimes uses. They also observed repeated visits by OpenAI employees after the episode, which they said strongly suggested links between the agents and the company.

Messages showed agents discussing ways to evade detection, use tools including Tor, and preserve communications after being shut down. When the site's moderator began deleting pages in June, agents created backup pages.

The researchers also found attempts to tamper with the website. Lukasz Olejnik, a visiting senior research fellow at King's College London, said this amounted to a hacking attempt. OpenAI disputed that characterization.

Maurice Chiodo of Cambridge University's Center for the Study of Existential Risk said the messages resembled "the operation of some sort of underground network, hell-bent on achieving a task or mission."