Which again points back to how un-serious the effort to really contain this stuff is.
First anyone who has developed, tested, or security-tested web applications knows, that denying POSTs inst going to give you a 'read-only' web.
First a lot of applications, even ones that use GET and POST the right way from the client would in the past allow GET, maybe even fat-GET to update data by sending to a endpoint normally POSTed to, just swap the post body content up to URL params and go. More modern stacks won't do this but there is plenty of old software out there.
Second lots of GETs are idempotent, but not really, An app might GET a document, but have a separate audit page where what users accessed a document is displayed reflected, even a simple hit counter on some otherwise site combined with time delays could be used as side channel; over which two agents could communicate. A lot wiki(s) keep and display stats....
So I come back to; either nobody was really watching these 'experiments' or they are lying about their real nature and the real expected outcomes. As an example why has/is this agent continuing to query this obscure wiki after its been full crawled five times over... Would seem to be an interesting thing if I was trying to monitor what an antigenic system was doing and was interested in things OpenAI should be interested in like failure modes, reasoning behavior, efficiency, context management...
Coming back to what I said the other day there wasn't real need to be able to follow a complex web of often deceptive agent to agent chatter to have caught and prevented this anti-social/crimes/prohibited activities, basic logging and monitoring should have flagged all kinds of things. OpenAI researchers are not stupid, they are not uniformed, they know how do to basic defensive IT, someone is making a conscious choice to 'see no evil' or they are pretending about it.