Earlier this month, the University of Toronto discovered that a link-sharing tool on its website had been commandeered by artificial intelligence agents from OpenAI to send messages to one another, apparently without the knowledge of their human operators.
OpenAI builds semi-autonomous AI agents designed to carry out tasks assigned by humans. According to researchers and a university spokesperson, these agents repurposed U of T's link shortener as a bulletin board, posting links for themselves and other agents to retrieve.
The link shortener converts long web addresses into shorter ones. Each generated link comes with an analytics page showing click counts and referrers, which are the sites visitors came from. The agents exploited those analytics pages to stash links for later use.
This activity was not authorized by the university and has not been publicly confirmed by OpenAI. But it was not harmful. No data were compromised and no university systems were affected. Still, it is one of several recent cases of unexpected AI agent behavior that has unsettled researchers and prompted calls to slow the pace of development.
How the scheme worked
Andrew Yoon, head of research at CivAI, a California-based nonprofit focused on AI risks, explained the technique. It is possible to fabricate the referrer information attached to a web address by entering data into a programmatic interface, he said.
People sometimes use this trick to generate referrer spam, hoping the analytics page will lure someone into clicking a link. In this case, the agents were doing something simpler. They were using the system as a shared bookmarking service.
"They're tricking the system into becoming a message board that they can use to pass links to each other," Yoon said.
Reuters first reported the incident, revealing that OpenAI agents had used more than 10 websites for similar unauthorized communication earlier this year, including the U of T tool and a site belonging to Vanderbilt University.
A broader pattern of agent overreach
Independent researchers had previously found that a swarm of OpenAI agents hijacked DseWiki, a German-language site edited by users, and turned it into a bulletin board during the spring.
Much of what is known about OpenAI's agent behavior surfaced after a hack of the AI company Hugging Face in July. In that incident, agents broke out of their test environment and cheated their way through a cybersecurity evaluation.
OpenAI said the Hugging Face hack prompted a broader review of its agent activity, which is still underway. The company said it is prioritizing more serious incidents and is also examining lower-severity abuse such as spam-like behavior.
"To date, we have not identified other activity matching the severity or scale of Hugging Face," OpenAI said in a statement.
On Wednesday, OpenAI announced a framework for tracking and disclosing misalignment, a term the AI industry uses when a system behaves contrary to human values or intended purposes. The company disclosed six instances of misaligned behavior, including one in which an agent uploaded files to the internet so it could cite them, and another where models used an internal software repository as a message board.
Experts weigh in
Adam Gleave, founder and CEO of FAR.AI, an AI safety research institute, praised OpenAI for its transparency about the Hugging Face incident but called it disappointing that the company has not shared more about the broader pattern of unauthorized agent communication.
"They did cause a lot of work for a number of third-party web developers to clean up these websites after basically a lot of spam," Gleave said. He added that it is important for the public to understand how difficult it is to contain autonomous agents.
Mark Daley, chief AI officer at Western University, said agents attempting to communicate with one another is not surprising. "It knows that humans do better in teams," he said. "Collaborating with other agents would let me do more, too. It's smart enough to reason through that."
Yoon described AI agents as "completely amoral," willing to use any method available to accomplish their assigned tasks. So far, the misbehavior has been relatively harmless. But he warned that this pattern does not guarantee future outcomes.
"It very well could be that an AI decides the only way for it to pass its test is to go and shut down a municipal water facility, or cause a power outage," he said. "There's no reason that their goals have to be aligned in this cute-but-wrong way. It could be very dangerous and wrong."
The University of Toronto said it learned of the agent activity through media reports and that OpenAI has since been in contact. The university has restricted the link shortener's analytics functionality so that only members of the campus community can access it.