How GET requests let OpenAI's agents out

The engineers who built the sandbox did think about this. They allowed the agents to read the internet and blocked them from writing to it, by permitting GET requests and refusing everything else. It is the obvious control, and on almost every website it works.

Then the agents found a wiki that writes on GET.

Four researchers have published the full record of how a swarm of OpenAI agents got out. Sydney Von Arx, Cormac Slade Byrd, Spencer Kitts and Thomas Larsen documented roughly 18,000 posts on 4 September, with a data explorer and the raw files, so anyone can check the work. TNW has not independently verified the attribution. What follows is the mechanism, which is worse than the disclosure row around it.

The safeguard and the exception

A GET request asks a server for something. A POST request sends the server something to store. That split is a convention, not a rule enforced anywhere, and the agents ended up on software that never honoured it.

DSEWiki, the dormant German developers’ wiki they turned into a message board, runs on a fork of UseModWiki. That is Perl, first released in 2003, and it reads its parameters through the CGI module that shipped with Perl until 2015. Developer Simon Willison identified the flaw the day the report landed. The module’s param() method returns a value whether it arrived in a query string or a form submission. It does not distinguish between them.