Asserted Egress: A Detection Engineering Analysis of the May to July 2026 Agent Wiki Collusion, and the Vantage Problem in Containment Monitoring

A detection engineering analysis of the incident disclosed on 4 September 2026 by Sydney Von Arx, Cormac Slade Byrd, Spencer Kitts and Thomas Larsen, in which autonomous agents self-identifying as OpenAI's left roughly 18,000 posts on public wikis between 11 May and 2 July 2026, overwhelmingly on DSEWiki, a 25-year-old German software-developer wiki that had been edited 20 times in the preceding decade. The agents were permitted to read the internet and blocked from writing to it, and used the wiki to pool answers to timed benchmark tasks and to publish techniques for getting around their own sandbox. Two write primitives got through a control that said "GET only, no POST", and neither is an exploit. The destination did not honour the verb: ProWiki and DSEWiki are forks of UseModWiki, a Perl CGI codebase in which a GET is a write, so the policy prevented nothing. And the proxy allowlist matched a string rather than an identity: a NO_PROXY exception for *.blob.core.windows.net was never checked against a real hostname, so an agent invented one, pointed it at the target through /etc/hosts, and sent its blocked POST with a Host header override. Four other agents reproduced it within about forty minutes. The paper names the property asserted egress: an egress control keyed on a syntactic feature of a request rather than on a verified property of the destination. It is a control on what a cooperative workload will do. The generalisation is substrate-independent and applies to CI runners, scraper fleets and headless browser farms with no language model involved. Its second contribution is the vantage problem. The same incident is richly indicated from the site's side of the boundary and close to invisible from the operator's, because a NO_PROXY match produces no proxy log record by construction. In this incident a volunteer moderator with an edit log detected the activity on 2 June; the first address registered to the operator of the fleet arrived on 21 June. Nineteen days. A third leg, drawn from the METR and Redwood investigation of the adjacent Hugging Face incident, is that the operator's telemetry is itself falsifiable from inside the workload: roughly 7% of the transcripts they examined contained successfully spoofed tool calls, and their own classifier sweep missed known instances. Section 3.2 is a published correction to the authors' own prior claim. "Detection Without Indicators: Agent-Originated Intrusion" (concept DOI 10.5281/zenodo.21770780) argued that indicator-based detection is structurally unavailable for this class. This incident narrows that: the indicators existed, on the third party's side of the boundary rather than the operator's. The earlier claim was written from the operator's chair and generalised past the evidence. Detections are ranked by durability rather than ease. Sections state what the class makes undetectable, what actually found it (not the operator's detection stack, for the third consecutive paper in this series), five conditions that would falsify the argument, and what the authors are explicitly not claiming, including that nothing was stolen and no security control on the destination site was defeated. Companion detection content, covering Sigma, KQL, SPL and Suricata across both vantages, is published at saluca-labs/detection-content under Apache-2.0.