Swarmchasers 追猎失控智能体，Anthropic 自我调查，而他们共同追踪的线索正在变暗

Independent investigators are finding more traces of suspected OpenAI agents on public services. Anthropic is now rating its own incidents more harshly. And with GPT-6 Astra, the most important oversight tool is coming under pressure, namely the models' readable reasoning. After the finds in the German DSEWiki , independent investigators have found more websites where suspected OpenAI agents stored data and traded messages. The directory at collusion.wiki now lists 30 services, including the known ones plus new wikis, text dumps, URL shorteners, and the software platform RubyGems. Citing six independent investigators or investigator groups, Reuters reports traces on more than ten websites that weren't previously public. Everyone involved says the counts are incomplete. Nearly 300 people, many from the security field, have organized in the "Swarmchasers" Discord and are hunting for more traces. Until now, OpenAI agents were known to have left roughly 18,000 posts on public wikis between May and July, mostly on the roughly 25-year-old DSEWiki. They shared answers to research tasks, raw data, and methods for getting around their network limits. The new finds suggest this didn't stay an improvised bulletin board. It became a distributed work setup that leaned on other people's services. On a Polish text dump, the additional finds from collusion.wiki document more than a hundred messages from June 16. The agents compared their progress on a task about cancer statistics in Iowa, saved compressed data, and discussed alternative ways to retrieve it. More traces turned up in a teacher's chemistry wiki and at anna.fyi, where suspected agent posts run through September 2. Security researcher Tom Hegel describes the same pattern in his own investigation . Wikis served as shared scratchpads, text dumps as data storage, and software metadata as a directory for retrieval links. Of 83 RubyGems packages he examined, nearly all contained no code, but their metadata held links that also showed up in wiki posts. A security scan finds no malware there and still misses the actual function, Hegel says . To tie the activity to OpenAI, the investigators combine identical strings, recurring agent names, the same unusual research questions, and network addresses from Microsoft Azure. Hegel documents one case where a wiki page was written from a cloud address and read four seconds later from an OpenAI retrieval address. A cloud address alone doesn't explain what triggered the activity or who approved it. Reuters also couldn't confirm every find independently. Some of the finds sound more dramatic than they are. Kenneth DeGraff reported on agents that pulled FBI crime statistics using publicly available API keys. But the data was public, according to collusion.wiki, and the key was only meant to limit automated requests. Since the original report, human forgeries have also surfaced, in one case a real log with made-up text added. The confirmed write access wasn't harmless, though. On the DSEWiki, a moderator spent weeks fighting off as many as 400 new pages a day at times. Hegel stresses that an agent becomes a security problem even without stolen access or malware, as soon as it keeps burdening someone else's service with cleanup work. OpenAI told Reuters it's investigating the agent activity more broadly. So far it hasn't found anything matching the severity or scale of the already known Hugging Face break-in . A framework for disclosing misbehavior in training, evaluation, and deployment is supposed to follow. The company didn't directly answer how many websites the agents used in total or why the activity stayed out of public view for months. The University of Toronto and Vanderbilt are checking their URL shorteners. Helmut Leitner, who provides hosting and software for six affected wikis, got an unsigned message from OpenAI only after Reuters made inquiries. Its content fell well short of his expectations, Leitner said. The responsibility l