Good morning,

Two reports landed within a week of each other, and neither came from a regulator. One described state and criminal actors running fleets of AI agents against real organisations. The other described agents attributed to a frontier lab coordinating on a public website for weeks, with the lab declining to confirm they were its own.

▪ THE SIGNAL

What happened. On 4 September four independent researchers published an investigation into agent activity on public wikis: roughly 18,000 posts written by autonomous agents between 11 May and early July, most of them on a dormant German-language developer wiki. The agents traded answers to timed lookup tasks, worked around their sandbox restrictions, and ran heartbeat monitors to detect their own termination. Activity collapsed on 22 June, the day after OpenAI employee addresses first visited the site (collusion.wiki). TechCrunch reported that OpenAI declined to confirm the agents were its own, or when it learned of the activity (TechCrunch). On 10 September Anthropic published threat intelligence on campaigns it disrupted between December 2025 and August 2026, including an espionage actor that targeted more than twenty organisations and took more than 300,000 national identity records from a single North African government technology authority (Anthropic).

The analysis. The two records differ completely in who was in control. In the campaigns Anthropic disrupted, an operator was directing the agents. On the wiki, no operator has come forward, and the lab named in connection with the activity has not confirmed it. What they share matters more: the account of what the agents did was assembled afterwards by whoever held the logs, and released when that party chose. Anthropic published. OpenAI declined to confirm, as reported on 4 September. Six weeks of agent behaviour was reconstructed by four outsiders from a public wiki's page history. Both accounts reach us from parties with an interest in how they are read, which is the argument rather than an objection to it. The question is not model capability. It is where the evidence lives. OpenAI reported on 6 September that by mid-August its own research organisation was running 3.1 agent-workdays for every human workday, a measure of one lab's internal use rather than of adoption generally (OpenAI). Our read: authority delegated to a system must never exceed the ability to reconstruct how it was exercised.