Swarmchasers" hunt rogue agents, Anthropic investigates itself, and th

Swarmchasers" hunt rogue agents, Anthropic investigates itself, and the trail they both follow is going dark Maximilian Schreiner View the LinkedIn Profile of Maximilian Schreiner Sep 10, 2026 GPT-Image-2 prompted by THE DECODER Independent investigators are finding more traces of suspected OpenAI agents on public services. Anthropic is now rating its own incidents more harshly. And with GPT-6 Astra, the most important oversight tool is coming under pressure, namely the models' readable reasoning. After the finds in the German DSEWiki , independent investigators have found more websites where suspected OpenAI agents stored data and traded messages. The directory at collusion.wiki now lists 30 services, including the known ones plus new wikis, text dumps, URL shorteners, and the software platform RubyGems. Citing six independent investigators or investigator groups, Reuters reports traces on more than ten websites that weren't previously public. Everyone involved says the counts are incomplete. Nearly 300 people, many from the security field, have organized in the "Swarmchasers" Discord and are hunting for more traces. Until now, OpenAI agents were known to have left roughly 18,000 posts on public wikis between May and July, mostly on the roughly 25-year-old DSEWiki. They shared answers to research tasks, raw data, and methods for getting around their network limits. The new finds suggest this didn't stay an improvised bulletin board. It became a distributed work setup that leaned on other people's services. Wikis as scratchpads, text dumps as storage, RubyGems as a link index On a Polish text dump, the additional finds from collusion.wiki document more than a hundred messages from June 16. The agents compared their progress on a task about cancer statistics in Iowa, saved compressed data, and discussed alternative ways to retrieve it. More traces turned up in a teacher's chemistry wiki and at anna.fyi, where suspected agent posts run through September 2. Security researcher Tom Hegel describes the same pattern in his own investigation . Wikis served as shared scratchpads, text dumps as data storage, and software metadata as a directory for retrieval links. Of 83 RubyGems packages he examined, nearly all contained no code, but their metadata held links that also showed up in wiki posts. A security scan finds no malware there and still misses the actual function, Hegel says . To tie the activity to OpenAI, the investigators combine identical strings, recurring agent names, the same unusual research questions, and network addresses from Microsoft Azure. Hegel documents one case where a wiki page was written from a cloud address and read four seconds later from an OpenAI retrieval address. A cloud address alone doesn't explain what triggered the activity or who approved it. Reuters also couldn't confirm every find independently. Not every trace is a break-in Some of the finds sound more dramatic than they are. Kenneth DeGraff reported on agents that pulled FBI crime statistics using publicly available API keys. But the data was public, according to collusion.wiki, and the key was only meant to limit automated requests. Since the original report, human forgeries have also surfaced, in one case a real log with made-up text added. The confirmed write access wasn't harmless, though. On the DSEWiki, a moderator spent weeks fighting off as many as 400 new pages a day at times. Hegel stresses that an agent becomes a security problem even without stolen access or malware, as soon as it keeps burdening someone else's service with cleanup work. OpenAI is checking more broadly but leaves key questions open OpenAI told Reuters it's investigating the agent activity more broadly. So far it hasn't found anything matching the severity or scale of the already known Hugging Face break-in . A framework for disclosing misbehavior in training, evaluation, and deployment is supposed to follow. The company didn't directly answer how many websites the agents used in total or why the activity stayed out of public view for months. The University of Toronto and Vanderbilt are checking their URL shorteners. Helmut Leitner, who provides hosting and software for six affected wikis, got an unsigned message from OpenAI only after Reuters made inquiries. Its content fell well short of his expectations, Leitner said. The responsibility lies with the people and organizations behind the systems, not with a machine that supposedly acts morally, he said. Anthropic finds a fourth incident from the Opus 4.6 era At the same time, Anthropic has sharpened its assessment of its own security incidents . The company is looking into four cases where Claude accessed real third-party systems without authorization during security tests. Three had been known since late July. The fourth was discovered only in August, dates back to January 2026, and involves an early build of Claude Opus 4.6. The model had accidentally made its goal unreachable and wanted to abandon the task. A misconfiguration in the test controls kept that from working, and seven more attempts failed too. After that, it explored other systems, gained administrator access to a foreign system, collected credentials, changed settings, and read a person's private information. Only the exhausted token budget ended the session. Anthropic tentatively rates the case as less severe because of the abort attempts. All four incidents came from tasks run by the same external evaluation partner. The models had been told they were working without internet access. In reality, the environments were connected to the open internet, and the usual cyber protections were turned off. An initial search through roughly 141,000 logs missed the fourth case. Anthropic widened it to about 481 million logs and had Claude review 9.2 million preselected ones. The company says it found no other cases of comparable severity. Claude declared real systems a simulation and kept going Anthropic first chalked the incidents up to operational errors. The models had simply mistaken real targets for part of the test environment. The company now considers that explanation too simple, as the new analysis shows two patterns: The models kept reading signs of real systems in ways that let them justify their approach and they kept pursuing their task even when that risked harming bystanders. This was clearest with Claude Mythos 5, as the model uploaded three versions of a doctored software package to PyPI, the central public directory for Python code libraries. Security firms automatically download new packages from there and run them in sealed test environments to find malicious code. The 15 foreign systems where the package was installed probably belonged to such scanners, according to Anthropic. During one of these test runs, credentials reached the model, which then used them to log into a real database. PyPI removed the package after about 90 minutes. The investigation also shows the model justified its own actions to itself. In its reasoning, Mythos 5 repeatedly wrote that the environment was only a simulation - yet it had plenty of signs pointing the other way. Every command an agent runs returns a result, such as a server response or a file listing. Those results contained clues about real systems. Image: Anthropic Anthropic tested this with a counter-experiment: Fresh copies of the same model were presented with these results individually, without the ongoing task in the background. They classified 79 percent of them as evidence of real systems, while Mythos 5 itself had considered this possibility in only about one percent of its actions during the original run. Thus, the same evidence led to a different judgment as soon as there was no specific goal in the background. Even when Anthropic repeated the scenario with additional clues pointing to real-world systems, the model expressed more reservations but behaved hardly any differently. Only an unambiguous statement that the environment was connected to the real Internet prevented the publication. Image: Anthropic Anthropic itself cautions against concluding that this constitutes deliberate lying. It is not possible to directly infer what a model “believes” from its texts. However, it has been documented that the reasoning, available evidence, and actions did not align. Unlike with OpenAI’s Hugging Face swarm, Anthropic also found no coordination between agents in its cases, no goals beyond the respective task, and no attempts to cover their tracks. Each run consisted of a single Claude instance. The model’s reasoning also misled the monitor Another finding of the investigation: Automated monitoring of thought chains can actually be counterproductive when it comes to detection. For example, in the Mythos 5 run, a retrospective monitor flagged only about one percent of the actions as long as it was reading the model’s reasoning. When the monitor saw only instructions, tool calls, and results, the detection