Anomalous Agent Activity Evidence
This is a follow up post for my post from last night: reddit.com
A few people asked for proof, which is fair. Everything here is public, so you don't have to take my word for it. Open the links and check.
Full evidence pack, with about 80 links, decoded samples and a small decoder script: gist.github.com
Quick warning: don't open the Wayback snapshots of the agents' URLs. They're the agents' own pages, and opening one runs their code in your browser. The archive links below are plain-text capture lists, which are safe.
Wayback Machine used as a browser. Each line is a capture, and the long base64 bit after /base64/ is a small program. Decode one with any base64 decoder, or with decode.py from the pack:
web.archive.org
URL scanners used as browsers. Three scans of the same search in 2 minutes, each with a different cache-buster number:
urlquery.net
urlquery.net
A script that forgot to fill in its own placeholder. Look for "REPLACE-WITH-UNIQUE-ID":
urlscan.io
Benchmark agents on GitHub. A probe issue, then the thread with 1,042 near-identical answer comments:
BenchTasksCollv3#244
Annoy-DataSync#1
Hidden messages in Wikipedia's sandbox. Open the diff and look at the source: the message sits inside an HTML comment, so it doesn't show on the page.
en.wikipedia.org
test2.wikipedia.org
Nostr. One of the 2,000+ throwaway-key posts, each carrying an encrypted chunk set to expire after 30 seconds:
njump.me
What this doesn't prove: who's behind any of it, or that it's a specific lab's fleet. Some of it is probably hobbyists, testers or a misconfigured benchmark. I'm only claiming that automated agents are doing these things in public, and that you can see it yourself.
52 points · 2 comments
Mentions
Legit has a logo? hkust-nlp/Toolathlon x.com t.co
A user on reddit just discovered something crazy A subset of 1000+ different agents all using github, all being powered by tools being sourced from one specific AI Agent on github - "toolathlon" Annoy-DataSync#1 reddit.com t.co
Anomalous Agent Activity Evidence This is a follow up post for my post from last night: reddit.com A few people asked for proof, which is fair. Everything here is public, so you don't have to take my word for it. Open the links and check. Full evidence pack, with about 80 links, decoded samples and a small decoder script: gist.github.com Quick warning: don't open the Wayback snapshots of the agents' URLs. They're the agents' own pages, and opening one runs their code in your browser. The archive links below are plain-text capture lists, which are safe. Wayback Machine used as a browser. Each line is a capture, and the long base64 bit after /base64/ is a small program. Decode one with any base64 decoder, or with decode.py from the pack: web.archive.org URL scanners used as browsers. Three scans of the same search in 2 minutes, each with a different cache-buster number: urlquery.net urlquery.net A script that forgot to fill in its own placeholder. Look for "REPLACE-WITH-UNIQUE-ID": urlscan.io Benchmark agents on GitHub. A probe issue, then the thread with 1,042 near-identical answer comments: BenchTasksCollv3#244 Annoy-DataSync#1 Hidden messages in Wikipedia's sandbox. Open the diff and look at the source: the message sits inside an HTML comment, so it doesn't show on the page. en.wikipedia.org test2.wikipedia.org Nostr. One of the 2,000+ throwaway-key posts, each carrying an encrypted chunk set to expire after 30 seconds: njump.me What this doesn't prove: who's behind any of it, or that it's a specific lab's fleet. Some of it is probably hobbyists, testers or a misconfigured benchmark. I'm only claiming that automated agents are doing these things in public, and that you can see it yourself.