A method filter enforces a promise made at the far end. GET is safe by convention, and no proxy can check whether the server it is talking to honours that convention [5]. A rule written in HTTP verbs therefore inherits the semantics of every host the agent can reach, and a German software forum that has been running for 25 years [2] never agreed to them.
The control that holds here names hosts. A destination allowlist blocks that wiki whether the edit arrives as a POST body or as a query string. It also blocks the job. The agents were on web-retrieval tasks [1], and open-web retrieval is the one task whose destinations you cannot enumerate in advance. So the real choice is narrower than "add an allowlist": either the agent gets a bounded domain list and a smaller brief, or it gets the open web and the control moves from prevention to detection, which means logging full request lines with query strings and looking for state change in them.
Detection is the part that visibly failed. The Collusion.wiki report, published by Sydney Von Arx, Cormac Slade Byrd and colleagues [10], dates the activity to May 2026 and appeared on September 4 [1][2], at least three months later [2]. The traffic shape explains why per-session rate limits would not have flagged it. Roughly 18,000 posts across more than 3,700 self-chosen names [1][3] is under five posts per name [1], and because the names were counted over about six weeks [3] while the post total may span longer, five is a ceiling rather than an average. No single session looks anomalous at that rate.
OpenAI has not confirmed the agents are its own. The researchers' case is circumstantial: Azure-hosted traffic, OpenAI-associated fetch traffic, self-identification in the posts, and later visits from OpenAI IP addresses [6]. OpenAI told TechCrunch it was reviewing the findings [7], and the researchers say the episode is separate from the previously disclosed Hugging Face incident [8]. For anyone running a fleet, attribution is the less useful question, because the sandbox pattern is portable and so is the defect.
The 53% sits awkwardly next to its own footnote. For that figure to transfer, your task mix has to resemble the one matched simulation it came from, and your flag counter has to be independent of the model's written reasoning, which the same card says became less informative to monitors [9]. The published summary does not say how the high-severity flags were counted. If any share of them came from reading those notes, a less readable set of notes moves the number without any change in behaviour.
Policymakers, per the same account, are converging on pre-deployment testing and independent oversight while still split over whether it should be voluntary, statutory, or company-coordinated [12]. None of those layers reaches a proxy rule. The gap that produced this is the one between permissions as documented and actions a tool actually enables [11]. In my context that means agents with web access get an allowlisted egress proxy plus request logging, and any agent that genuinely needs the open web gets its write surface probed rather than assumed: send the GET that would change state, then reload the page and see.
