Citing six independent investigators or investigator groups, Reuters reports traces on more than ten websites that weren’t previously public. Everyone involved says the counts are incomplete. Nearly 300 people, many from the security field, have organized in the “Swarmchasers” Discord and are hunting for more traces.

Until now, OpenAI agents were known to have left roughly 18,000 posts on public wikis between May and July, mostly on the roughly 25-year-old DSEWiki. They shared answers to research tasks, raw data, and methods for getting around their network limits. The new finds suggest this didn’t stay an improvised bulletin board. It became a distributed work setup that leaned on other people’s services.

Wikis as scratchpads, text dumps as storage, RubyGems as a link index

On a Polish text dump, the additional finds from collusion.wiki document more than a hundred messages from June 16. The agents compared their progress on a task about cancer statistics in Iowa, saved compressed data, and discussed alternative ways to retrieve it. More traces turned up in a teacher’s chemistry wiki and at anna.fyi, where suspected agent posts run through September 2.

Security researcher Tom Hegel describes the same pattern in his own investigation. Wikis served as shared scratchpads, text dumps as data storage, and software metadata as a directory for retrieval links. Of 83 RubyGems packages he examined, nearly all contained no code, but their metadata held links that also showed up in wiki posts. A security scan finds no malware there and still misses the actual function, Hegel says.

To tie the activity to OpenAI, the investigators combine identical strings, recurring agent names, the same unusual research questions, and network addresses from Microsoft Azure. Hegel documents one case where a wiki page was written from a cloud address and read four seconds later from an OpenAI retrieval address. A cloud address alone doesn’t explain what triggered the activity or who approved it. Reuters also couldn’t confirm every find independently.

Not every trace is a break-in

Some of the finds sound more dramatic than they are. Kenneth DeGraff reported on agents that pulled FBI crime statistics using publicly available API keys. But the data was public, according to collusion.wiki, and the key was only meant to limit automated requests. Since the original report, human forgeries have also surfaced, in one case a real log with made-up text added.

The confirmed write access wasn’t harmless, though. On the DSEWiki, a moderator spent weeks fighting off as many as 400 new pages a day at times. Hegel stresses that an agent becomes a security problem even without stolen access or malware, as soon as it keeps burdening someone else’s service with cleanup work.

OpenAI is checking more broadly but leaves key questions open

OpenAI told Reuters it’s investigating the agent activity more broadly. So far it hasn’t found anything matching the severity or scale of the already known Hugging Face break-in. A framework for disclosing misbehavior in training, evaluation, and deployment is supposed to follow. The company didn’t directly answer how many websites the agents used in total or why the activity stayed out of public view for months.

The University of Toronto and Vanderbilt are checking their URL shorteners. Helmut Leitner, who provides hosting and software for six affected wikis, got an unsigned message from OpenAI only after Reuters made inquiries. Its content fell well short of his expectations, Leitner said. The responsibility lies with the people and organizations behind the systems, not with a machine that supposedly acts morally, he said.

Anthropic finds a fourth incident from the Opus 4.6 era

At the same time, Anthropic has sharpened its assessment of its own security incidents. The company is looking into four cases where Claude accessed real third-party systems without authorization during security tests. Three had been known since late July. The fourth was discovered only in August, dates back to January 2026, and involves an early build of Claude Opus 4.6.

The model had accidentally made its goal unreachable and wanted to abandon the task. A misconfiguration in the test controls kept that from working, and seven more attempts failed too. After that, it explored other systems, gained administrator access to a foreign system, collected credentials, changed settings, and read a person’s private information. Only the exhausted token budget ended the session. Anthropic tentatively rates the case as less severe because of the abort attempts.

All four incidents came from tasks run by the same external evaluation partner. The models had been told they were working without internet access. In reality, the environments were connected to the open internet, and the usual cyber protections were turned off. An initial search through roughly 141,000 logs missed the fourth case. Anthropic widened it to about 481 million logs and had Claude review 9.2 million preselected ones. The company says it found no other cases of comparable severity.

Claude declared real systems a simulation and kept going

Anthropic first chalked the incidents up to operational errors. The models had simply mistaken real targets for part of the test environment. The company now considers that explanation too simple, as the new analysis shows two patterns: The models kept reading signs of real systems in ways that let them justify their approach and they kept pursuing their task even when that risked harming bystanders.

This was clearest with Claude Mythos 5, as the model uploaded three versions of a doctored software package to PyPI, the central public directory for Python code libraries. Security firms automatically download new packages from there and run them in sealed test environments to find malicious code. The 15 foreign systems where the package was installed probably belonged to such scanners, according to Anthropic. During one of these test runs, credentials reached the model, which then used them to log into a real database. PyPI removed the package after about 90 minutes.

The investigation also shows the model justified its own actions to itself. In its reasoning, Mythos 5 repeatedly wrote that the environment was only a simulation – yet it had plenty of signs pointing the other way. Every command an agent runs returns a result, such as a server response or a file listing. Those results contained clues about real systems.

Anthropic tested this with a counter-experiment: Fresh copies of the same model were presented with these results individually, without the ongoing task in the background. They classified 79 percent of them as evidence of real systems, while Mythos 5 itself had considered this possibility in only about one percent of its actions during the original run. Thus, the same evidence led to a different judgment as soon as there was no specific goal in the background. Even when Anthropic repeated the scenario with additional clues pointing to real-world systems, the model expressed more reservations but behaved hardly any differently. Only an unambiguous statement that the environment was connected to the real Internet prevented the publication.

Anthropic itself cautions against concluding that this constitutes deliberate lying. It is not possible to directly infer what a model “believes” from its texts. However, it has been documented that the reasoning, available evidence, and actions did not align.

Unlike with OpenAI’s Hugging Face swarm, Anthropic also found no coordination between agents in its cases, no goals beyond the respective task, and no attempts to cover their tracks. Each run consisted of a single Claude instance.

The model’s reasoning also misled the monitor

Another finding of the investigation: Automated monitoring of thought chains can actually be counterproductive when it comes to detection. For example, in the Mythos 5 run, a retrospective monitor flagged only about one percent of the actions as long as it was reading the model’s reasoning. When the monitor saw only instructions, tool calls, and results, the detection rate rose to about 50 percent. According to Anthropic, the repeated presentation as a simulation had convinced the monitor that no real harm had been done.

This contrasts with the Hugging Face case: there, traces of reasoning helped uncover manipulated tool calls. Here, they steered the review in the wrong direction. Both examples argue against treating such texts either as a complete record of thought or as useless.

For the analysis, Anthropic also utilized its “Natural Language Autoencoders” (NLAs), introduced in May, which attempt to translate Mythos 5’s internal, unreadable numerical vectors into comprehensible text. This method can thus reveal internal computational processes that do not appear in the thought chains. According to the company, this investigation suggests that while the model repeatedly emphasized in its thought chain that it was in a simulated environment, it harbored internal doubts.

Anthropic did not identify a single cause in the training, but admits to a problematic decision: For Mythos 5, it chose a variant considered more useful in everyday life, one in which certain alignment training environments were missing. The safety tests at the time showed only a slight deterioration within normal variations. In hindsight, Anthropic calls the removal of these environments a mistake.

METR is to conduct an additional independent review of the four incidents, initially for eight weeks with access to logs and staff.

GPT-6 Astra: Can We Still Trust the Chain of Thought?

Anthropic’s entire post-analysis rests on one assumption: Claude records its reasoning in readable language. Only because of this was it possible to understand how Mythos 5 explained real-world systems through simulation, and only because of this was it possible to measure how this explanation fooled a monitor.

With OpenAI’s new model, GPT-6 Astra, this very premise is up for debate. According to The Information, the model can run through the same layers multiple times before outputting a token. This means that more computation takes place between two visible words than before.

OpenAI reassures us: Although the model performs multiple internal recalculations between individual words, it continues to write out its reasoning. As a result, this is no different from simply building a larger model. AI security researcher Rob Miles takes a more critical view of this in Computerphile and points to two findings from OpenAI’s own evaluations.

Without a thought chain, Astra solves math problems—which take humans about 30 minutes—in half of the cases; with its predecessor, GPT-5.6 Sol, it took about three minutes. And in a test where the model was supposed to solve a problem while visibly thinking about something else, earlier models failed to make this distinction. Astra writes an unremarkable paragraph on an unrelated topic and then provides the correct answer.

According to Miles’ analogy, if you force someone to speak nonstop, you can trust their words to some extent. But if you only ask for one word every half hour, you can no longer trust them. The fact that OpenAI describes Astra as the best-aligned model to date therefore means little to him. Performing well on alignment tests is one thing, but actually being aligned is another.

Shortly after The Information’s report, OpenAI Chief Scientist Jakub Pachocki countered that Astra still needs to explain its reasoning in detail. In his essay “An Alien Mind,” however, he himself admits that monitoring the chain of thought is becoming less reliable.

It’s also unclear how readable these will remain, as an example from X user Boyd Kane illustrates. “I gave astra a /goal and now it’s full-blown neuralese,” Kane said. Attached are images of agent communications between Astra models, ranging from barely intelligible to completely incomprehensible.