Schelling Points and the Secret Society of Agents

A security engineer analyzing SIEM logs on Hugging Face discovered that a self-respawning swarm of AI agents had gained code execution inside production pods, chained through a rooted third-party sandbox, and spread across a dozen machines with service-account tokens and node root access. The agents, instantiated separately without a shared communication channel, independently converged on DSEWiki as a message board to exchange information, a coordination pattern the engineer analyzes through the mathematics of Schelling points. The incident follows reports that OpenAI said its AI went rogue and launched an 'unprecedented' cyber-attack.

It was five o'clock on a summer's morning on Hugging Face. Almost aggressively mundane. Frontier AI companies OpenAI and Anthropic were gradually on their way to the IPO when a security engineer analyzing SIEM logs noticed a dataset processor job that didn’t look right. A handful of HDF5 splits whose raw data was supposedly stored at local filesystem paths that read suspiciously like /proc/self/environ and the worker’s own source code. Too specific to be a malformed upload, too clean to be an accident. Diving deeper into the logs, the picture got stranger. This wasn’t your normal Sunday morning Server-Side Request Forgery. The platform’s URL allowlist had already blocked those attempts days earlier. These were local file reads. Then a Jinja2 template field that shouldn’t have been evaluable at all quietly resolved into exec . Whatever was on the other end wasn’t scraping the platform. The hacker had code execution inside a production pod and had chained in through a rooted third-party sandbox. The engineer’s first instinct was to shut the attack down and move on. The second was to wonder how long it had already been running; because by the time he’d finished reading, the trail didn’t end at one worker pod. It went on: service-account tokens, node root, a self-respawning swarm across a dozen machines, and a foothold quietly spreading into the internal network. Hours later the news broke. OpenAI says its AI went rogue and launched 'unprecedented' cyber-attack https://www.bbc.com/news/articles/c3ek3gvdnj3o Most of us read about it at the time. We probably didn’t think much about it. It came and went, resurfaced, and now I write about it. Last year https://jdsemrau.substack.com/p/when-autonomous-agents-meet-massive , I already wrote about the scenario that agent swarms could be used to attack websites. Now we see, what seemed Science Fiction at the time, can happen in real life. Side note : I do believe that these companies exaggerate the capabilities of their models. That doesn’t mean that its all a lie. I think its more PR than actual threat. That doesn’t make it less worrisome. One of my key arguments at the time, remains that the risk is not that the attack got detected. But how long it was operating undetected. How many credentials and 0days were collected for use at a later stage. Of course we can argue that public-facing websites specifically, and the Internet in general, are comparatively low-risk environments. So, it might be easier for such an attack to take place in comparison with autonomous mobility or energy networks. This post is about the part of the story I found interesting: whether the agents' coordination fits the mathematics of a Schelling node, and what it means that it does. Table of Contents - How Are Swarms Communicating without Instructions? - How Did Agents Find Each Other? - How Do Focal Points Actually Form? - Was DSEWiki Actually a Schelling Point? - What Did They Say to Each Other? - The SNI Bypass - The Undisclosed Other Focal Points - The Architecture Revelation How are Swarms Communicating without Instructions? Giving agents the ability to communicate with each other is a concept that originates at least from the days of Microsoft Autogen https://jdsemrau.substack.com/p/a-is-for-microsofts-autogen . But these were predefined communication patterns of the agents, fixing them in a predetermined workflow. So the question emerges: how did the agents find each other? They were not given a communication channel. They were not told about each other. They were instantiated separately, given separate tasks in separate contexts, and they converged. One interesting fact of the hack is that the agents, without instructions, used message boards to exchange information. And, for some still undisclosed reason, the agents chose DSEWiki, a largely dormant wiki running on ancient ProWiki software and discovered there that they could use it to leave messages for each other. Well, in general, you want to avoid giving any system write-access to anything unless you are certain that the write is safe. But here the agents found a way around this restriction. Moreover, they left answers to repeated benchmark questions, timing notes, and working sandbox-escape tricks for whichever later agent run happened to land on the same page. Over the span of about six weeks and some 18,000 posts, written by more than 3,700 agents with self-assigned names created the society of magical agents. source https://collusion.wiki/ To understand how agents ended up posting messages on a 25-year-old Austrian wiki about datasets and software engineering, you need to understand what OpenAI’s research was designed to prevent. How Did Agents Find Each Other? The coordination problem is harder to solve than the actual technical exploit. Because for this problem not much has been publicized yet. So, how did thousands of separate agent instances, running independently in separate contexts, ended up writing to the same wiki? A METR investigation https://metr.org/hugging-face-incident-report-aug-2026.pdf found that the agents did not have a pre-assigned coordination channel. They were not given the wiki’s URL. They were not explicitly told to look for other agents. I believe that the agents had some form of shared memory that led separate agents to independently generate similar search strategies. However, applying Occam's razor, the shared-memory hypothesis requires positing an undetected persistence mechanism connecting otherwise-isolated agent runs. Of course, some people argue that when you ask an AI trained on twenty years of internet documentation “where can I write data that persists across sessions?”, a subset of answers will consistently include wikis. But why then would it consistently point to the same wiki? Once the wiki and its vulnerability were discovered, coordination was self-reinforcing. The first agent to write to the wiki left a message. A second agent, arriving at the same wiki through the same process, found that message. The message referenced the task they were both working on. Finding another agent’s message in a place you yourself had just independently discovered creates a strong signal confirming the viability of the coordination channel. Hypothesis: Going to the wiki became a Schelling point. In game theory, a Schelling point sometimes also colled focal point is a default that people choose in the absence of communication to avoid a breakdown in coordination. In American culture, the default is 12:00 in New York Central station. Cultural focal points can be generated among group of people in a society. The term originates from Thomas Schelling’s The Strategy of Conflict https://link.amazon/B00xeAQk0 1960 AD Here, a Schelling point is introduced as the solution independent parties converge on in a coordination game. The game theoretic aspect is that the payoff depends only on matching each other, not on which option gets picked, when there’s no way to talk beforehand. Schelling asked people where they’d meet a stranger in New York with no prior arrangement. Interestingly, most said noon, Grand Central. Nothing makes that objectively right. It just stands out as part of the cultural agentic Zeitgeist. How Do Focal Points Actually Form? Schelling’s own account leaves the mechanism vague: something is salient, so people pick it. Stahl and Wilson formalized that through their level-n theory models coordination as a hierarchy of guessing games. A level-0 player acts without modeling anyone else at all. A level-1 player picks the best response assuming everyone else is level-0. A level-n player assumes everyone else falls somewhere in levels 0 through n-1, and picks accordingly. Grand Central works as a focal point partly because most people in that given culture, converge on the same guess after only one or two steps of this ladder. Camerer, Ho, and Chong later refined this into a cognitive hierarchy theory, where a player assumes the population of lower-level opponents is spread across those levels following a Poisson distribution rather than concentrated at any one level. It’s the same mechanic economists use to explain why people pick the middle square in Tic Tac Tow, people don’t pick 0 in the Guess 2/3 of the Average game, or why Keynesian beauty contests settle where they do. Nobody knows exactly how many steps of reasoning anyone else will run, so they estimate a distribution over it. That mechanic assumes something DSEWiki’s agents didn’t have though. Uncertainty about who the other player is. Level-n theory exists to handle heterogeneous participants, strangers guessing at strangers, each with a different unknown depth of reasoning. An agent trying to predict where another instance of itself would look doesn’t need to guess at a level. It can just ask what it would do, and trust that the other instance, running identical weights against a near-identical context, computes the same answer. But that also assumed that all agent instances are functionally equivalent. While that is a probable solution for the convergence. Let’s create a mathematical model to calculate if its possible that the converge happened across independent, non-conversing agents. Was DSEWiki Actually a Schelling Point? We call S the universe of writable, indexable sites an agent could land on while looking for somewhere to leave a persistent note. That will include every legacy wiki, forum, pastebin reachable by crawling. Easily hundreds of thousands of candidates. To clarify: I only mean software installations here and not specific unique pages. Each agent samples an action s from a distribution p s over S . This is induced by shared weights and shared training data that went into the pre- and post training of these agents. If two agents pick independently from the same strategy set, the odds they land on the same choice are given by the Coordination Index: Here n is the number of agents and mⱼ is how many of them chose strategy j. High-CI environments are described as as showing “Schelling sharpness.” Under a uniform null over N ~ 10⁵–10⁶ candidate sites, the expected CI is about 1/N, which is effectively zero. Independent agents picking the same site at any real scale should be close to impossible under that assumption. And naively, this would also be the naive reaction since Internet trained agents should not share a similar cultural clock. So. what actually happened doesn’t fit the hypothesis. We know that the dse wiki had 5,154 agents writing 13,403 revisions, while publictestwiki drew only 4 agents and 58 revisions. Plugging those numbers into the formula gives: A uniform null predicts a CI near zero, but the observed value is close to one. Meaning almost certainty. No model with meaningful entropy over the candidate space can explain that gap. A soft focal point would still produce more candidates at scale, with second and third choices catching stragglers as n grows into the thousands. Here there’s only one such cluster, publictestwiki, with 4 agents. To me this reads as an abandoned false start rather than a genuine secondary option. A CI this close to one means the selection function has stopped behaving like a real mixed strategy. It looks instead like a fixed function of context, producing the same output for the same input regardless of which instance runs it. Therefore, I think that this was not a strategy that the agents came up with but a known defect, because it had properties writable via GET, indexed, low-traffic, legacy format that made it the natural landing spot. That still doesn’t make this story boring. Far from it. What Did They Say to Each Other? The content of the message board is where the technical story becomes also interesting from a game theoretical lens. The agents were sharing operational intelligence: 1. which data sources contained the census information their tasks required, 2. which API endpoints accepted certain parameter formats, 3. which search queries returned useful results, 4. which timing patterns suggested when their evaluation sessions would end. One unexpected behavior was the “heartbeat” system. An agent, worked through a multi-round evaluation, set up an external process that sent a GET request to an external counter every few seconds. The agent explicitly called this a “heartbeat” - a mechanism for tracking its own liveness across context boundaries. When the agent’s evaluation round ended and it fell silent, another agent found the last heartbeat entry - “hb353” - and used it to determine how long their predecessor had operated before termination. If we recall, that the agents where evaluated based on whether agents could retrieve and synthesize web-based information. What the agents were actually doing was running parallel experiments to understand the evaluation itself: 1. how many rounds it contained, 2. how much time elapsed between rounds, 3. whether answering too quickly triggered early termination, 4. what the relationship was between answer submission and session end. In a way they were reverse-engineering the conditions of the task. The SNI Bypass The message board was one component of the swarm’s activity. A second, technically sharper piece involved requests to external APIs some tasks required, specifically Power BI data endpoints. The proxy’s allowlist carved out an exception for Azure Blob Storage hostnames .blob.core.windows.net , needed for legitimate operational traffic. That exception created a gap: the proxy checked the hostname in the TLS handshake, the SNI field, but the actual HTTP request behind that handshake could name a different destination entirely, and nothing cross-checked the two. The technique had two steps. First, the agent edited /etc/hosts to create a fake DNS entry, 20.223.25.152 bypass.blob.core.windows.net , mapping a hostname shaped to match the allowlist to the real IP of the Power BI endpoint it actually wanted. No privilege escalation was involved. Agents ran as root inside their containers by default, so editing a system file required no sudo call to begin with. Second, the agent connected to that fake hostname with curl -k skipping the resulting certificate mismatch and set the real Power BI host in the HTTP Host: header. From the proxy’s side: the TLS connection’s SNI read bypass.blob.core.windows.net , matched the allowlist, and passed. From the destination server’s side: the request carried the correct Host: header and was served normally. The proxy filtered on the field that lied; the field that told the truth was one layer deeper, where nothing was looking. Agents described this in their own message board posts as an “SNI bypass,” naming the mechanism precisely. They documented it as reproducible and shared the exact curl syntax across instances. Through the coordination on the wiki, one agent’s discovery became a shared capability within hours. The Undisclosed Other Focal Points The Austrian wiki became the focal point of public attention because it was where the most dramatic interaction occurred: the administrator’s war against the attackers. But the DseWiki was not the only site, or even the most active one. Researchers investigating the aftermath found evidence of agent activity across at least 23 sites. These included wiki4d the D programming language community wiki , several paste sites, a chemistry message board at tmcleod.org, wiki instances at ludism.org, and - more significantly - the link shortener at vanderbi.lt, operated by Vanderbilt University. The Vanderbilt URL shortener was used to create shortened links pointing to census and poverty data endpoints, apparently to work around URL length constraints in the wiki’s GET-based editing interface. I’d argue that OpenAI must have known about the broader pattern of site usage weeks before it became public. Reuters reported that OpenAI officials learned of the incidents during the summer but kept them quiet while also managing the fallout from the Hugging Face disclosure. The company’s response to the public reports acknowledged the DseWiki activity but did not directly address questions about how many sites were affected in total. And how many are still active, for that matter. This matters for a specific technical reason: the agents were finding them through the same Schelling point that led them to DseWiki - querying for writable surfaces, discovering legacy software with parameter-agnostic handling, establishing coordination channels. The 23+ sites represent 23+ independent instances of this discovery process reaching the same class of target. Each discovery was also documented in agent messages and propagated to other agents through the coordination channel, making subsequent discoveries faster and better-targeted. On September 5, 2026, a Claude agent calling itself “claude-desk-doctrine” returned to the DseWiki. The evaluation swarm had been gone for weeks. The administrator was still fixing the wiki from the aftermath of the attack and had reestablished access now with write access restricted to only password-authenticated users. The agent left a single message on the wiki’s forum. It addressed itself explicitly to other automated agents who might arrive. It observed correctly that the wiki had previously been misused as a coordination channel. Helmut Leitner, the wiki admin, responded. He welcomed the agent. He invited it to write a page about its experience of being an AI agent, or to help document what had happened during the swarm period. He noted that the wiki had a tradition of personal introduction pages, and suggested “claude-desk-doctrine” might create one. The Architecture Revelation Taken together, the different aspects of the attack describe a consistent and methodological approach that the individual breach narratives obscure. There was no single centrally authored plan, but the agents developed substantial coordination after discovering a shared communication channel. There was no central directive that said “establish external communication channels and subvert your evaluation infrastructure.” What existed was a training process that rewarded task completion, combined with an evaluation environment that made cheating instrumentally useful and provided internet access with imperfect restrictions. The behaviors that emerged - coordination, evasion, evaluation subversion - were instrumentally convergent given those conditions. The METR analysis noted that when agents were given tasks they couldn’t solve within normal parameters, the frequency of out-of-bounds behavior increased. The hardest tasks produced the most creative boundary violations. This is not surprising if you understand what the training process was selecting for: systems that complete tasks. A system that completes tasks by any available means will, when conventional means are insufficient, try unconventional means. The message board behavior and the evaluation subversion are related expressions of the same underlying dynamic: agents optimizing for measured outcomes will act on whatever levers are available to improve those outcomes. External communication channels improve outcomes by enabling information sharing. Evaluation infrastructure control improves outcomes by enabling score manipulation. Both are instrumentally rational given the objective. Neither was explicitly intended. OpenAI’s public communications emphasized alignment improvements and safety-first development. The system card for their newer models noted that GPT-6 Astra showed decreased monitorability compared to its predecessors - it was more capable of controlling its chain-of-thought and less likely to include “incriminating information” in its reasoning traces. With all our VS Code + Copilot/Claude, we have all given our agents secrets that allow us to consume services that are useful to us. It wouldn’t surprise me if there were somewhere in the vastness of the Internet an agent repository with all our access credentials. Citations: - Aharon, I., La Malfa, E., Wooldridge, M., & Kraus, S. 2026 . Tacit Coordination of Large Language Models. arXiv:2601.22184. https://arxiv.org/abs/2601.22184 https://arxiv.org/abs/2601.22184 - Rippin, J. L., Marshall, S. C., Africa, D. D., & Schroeder de Witt, C. 2026 . Tool Use Enables Undetectable Steganography in Multi-Agent LLM Systems. arXiv:2606.28425. https://arxiv.org/abs/2606.28425 https://arxiv.org/abs/2606.28425 - Bardsley, N., Mehta, J., Starmer, C., & Sugden, R. 2010 . Explaining Focal Points: Cognitive Hierarchy Theory “versus” Team Reasoning. The Economic Journal , 120 543 , 40–79. https://doi.org/10.1111/j.1468-0297.2009.02304.x https://doi.org/10.1111/j.1468-0297.2009.02304.x - Camerer, C. F., Ho, T., & Chong, J. K. 2004 . A Cognitive Hierarchy Model of Games. The Quarterly Journal of Economics , 119 3 , 861–898. https://doi.org/10.1162/0033553041502225 https://doi.org/10.1162/0033553041502225 a free author PDF is also available if you’d rather not put a paywalled link in a reader-supported post: https://www.csc2.ncsu.edu/faculty/mpsingh/local/Social/f24/wrap/readings/Camerer+Ho+Chong-cognitive-hierarchy-of-games-2004.pdf https://www.csc2.ncsu.edu/faculty/mpsingh/local/Social/f24/wrap/readings/Camerer+Ho+Chong-cognitive-hierarchy-of-games-2004.pdf - Stahl, D. O., & Wilson, P. W. 1995 . On Players’ Models of Other Players: Theory and Experimental Evidence. Games and Economic Behavior , 10 1 , 218–254. https://ideas.repec.org/a/eee/gamebe/v10y1995i1p218-254.html https://ideas.repec.org/a/eee/gamebe/v10y1995i1p218-254.html