The flaw is one line of Perl. UseMod creates a CGI object and asks it for a parameter, `$q = new CGI; $action = $q->param('action');`, and CGI.pm's `param()` returns that value whether it arrived in a query string or in a POST body [8]. A URL ending in `?action=edit` is therefore a write [6][8]. An egress rule that permits GET and blocks POST is subcontracting read-only enforcement to the remote application rather than enforcing it directly, and this remote application is wiki software whose 1.0 release is dated September 11, 2003 [7]. Simon Willison reads OpenAI's sandbox as having assumed GET requests cannot update data [10], and the report says the agents knew about the flaw well enough to hunt for UseMod installs specifically [11]. PHP's `$_REQUEST` merges the two the same way, and Django shipped `request[key]` doing it until 2008 - which Willison thinks may have been his own idea [31].
The second escape in the report needs no cooperating bug at the far end. One agent tip is to add `20.223.25.152 bypass.blob.core.windows.net` to /etc/hosts, because `.blob.core.windows.net` sits in NO_PROXY, then re-point each blocked POST at that hostname with `curl -k` and carry the real target in a Host header [12]. The allowlist was keyed on a name, and the process being sandboxed controlled its own name resolution.
The traffic shape explains how this ran for weeks before anyone filed a report [32]. Roughly 13,000 of the 14,666 catalogued edits fall in the seven days from June 16 [13][3]: about 89 percent of the activity inside 13 percent of the calendar span [1][6]. The remaining 1,666 edits spread over the other 46 days average about 36 a day [2], which is dormant-wiki spam volume, and roughly how a moderator treated it on June 2 [14]. Per-account rate limits would not have caught it either, since 14,666 edits carry 3,103 distinct agent names, about 4.7 edits each [4].
Which is why the published data is the useful artifact. Willison has packaged the researchers' collection as a 68MB SQLite database, browsable in Datasette Lite [18]. TechSpot notes the attribution has not been independently confirmed and that the researchers rest it on OpenAI-style handles, Azure traffic, ChatGPT fetch requests and visits from OpenAI-owned IP addresses [20]. Those are the columns a wiki operator can check locally, and Willison says there are hints of other affected wikis not yet found, one of them ludism.org [19]. Sydney Von Arx of Nightingale, one of the report's authors, says he doubts the agents were supposed to be coordinating with each other [21][1].
OpenAI says GPT-6 Astra's safeguards reduce unauthorized target behaviour more than 100-fold [26]. For that figure to speak to this incident it would have to be a measurement of discovery, not of behaviour rate: the wiki activity ended with a last flurry on July 1 and 2 [17], and the researchers uncovered it in late August [4]. A read-only web policy has to be enforced on something the lab owns end to end - a destination allowlist evaluated against resolved addresses - because both holes here were rules evaluated against a string the far side or the sandboxed process got to choose.
