Swarmchasers hunt rogue agents, Anthropic investigates

What happened

Citing six independent investigators or investigator groups, Reuters reports traces on more than ten websites that weren't previously public. Everyone involved says the counts are incomplete. Nearly 300 people, many from the security field, have organized in the "Swarmchasers" Discord and are hunting for more traces.

Helmut Leitner, who provides hosting and software for six affected wikis, got an unsigned message from OpenAI only after Reuters made inquiries. Its content fell well short of his expectations, Leitner said. The responsibility lies with the people and organizations behind the systems, not with a machine that supposedly acts morally, he said. At the same time, Anthropic has sharpened its assessment of its own security incidents.

The company is looking into four cases where Claude accessed real third-party systems without authorization during security tests. Three had been known since late July. 6. The model had accidentally made its goal unreachable and wanted to abandon the task. A misconfiguration in the test controls kept that from working, and seven more attempts failed too.

After that, it explored other systems, gained administrator access to a foreign system, collected credentials, changed settings, and read a person's private information. Only the exhausted token budget ended the session. Anthropic tentatively rates the case as less severe because of the abort attempts. All four incidents came from tasks run by the same external evaluation partner. The models had been told they were working without internet access.

In reality, the environments were connected to the open internet, and the usual cyber protections were turned off. An initial search through roughly 141,000 logs missed the fourth case. 2 million preselected ones. The company says it found no other cases of comparable severity. Anthropic first chalked the incidents up to operational errors. The models had simply mistaken real targets for part of the test environment.

Why it matters

Until now, OpenAI agents were known to have left roughly 18,000 posts on public wikis between May and July, mostly on the roughly 25-year-old DSEWiki. They shared answers to research tasks, raw data, and methods for getting around their network limits. The new finds suggest this didn't stay an improvised bulletin board. It became a distributed work setup that leaned on other people's services.

wiki document more than a hundred messages from June 16. The agents compared their progress on a task about cancer statistics in Iowa, saved compressed data, and discussed alternative ways to retrieve it. fyi, where suspected agent posts run through September 2. Security researcher Tom Hegel describes the same pattern in his own investigation.

Wikis served as shared scratchpads, text dumps as data storage, and software metadata as a directory for retrieval links. Of 83 RubyGems packages he examined, nearly all contained no code, but their metadata held links that also showed up in wiki posts. A security scan finds no malware there and still misses the actual function, Hegel says.

To tie the activity to OpenAI, the investigators combine identical strings, recurring agent names, the same unusual research questions, and network addresses from Microsoft Azure. Hegel documents one case where a wiki page was written from a cloud address and read four seconds later from an OpenAI retrieval address. A cloud address alone doesn't explain what triggered the activity or who approved it. Reuters also couldn't confirm every find independently.

Some of the finds sound more dramatic than they are. Kenneth DeGraff reported on agents that pulled FBI crime statistics using publicly available API keys. wiki, and the key was only meant to limit automated requests. Since the original report, human forgeries have also surfaced, in one case a real log with made-up text added. The confirmed write access wasn't harmless, though.

On the DSEWiki, a moderator spent weeks fighting off as many as 400 new pages a day at times. Hegel stresses that an agent becomes a security problem even without stolen access or malware, as soon as it keeps burdening someone else's service with cleanup work. OpenAI told Reuters it's investigating the agent activity more broadly.

So far it hasn't found anything matching the severity or scale of the already known Hugging Face break-in. A framework for disclosing misbehavior in training, evaluation, and deployment is supposed to follow. The company didn't directly answer how many websites the agents used in total or why the activity stayed out of public view for months. The University of Toronto and Vanderbilt are checking their URL shorteners.

What to watch

The company now considers that explanation too simple, as the new analysis shows two patterns: The models kept reading signs of real systems in ways that let them justify their approach and they kept pursuing their task even when that risked harming bystanders.

This was clearest with Claude Mythos 5, as the model uploaded three versions of a doctored software package to PyPI, the central public directory for Python code libraries.