Public Site Agents and Claude Incidents: Supervision Failure

Activity indicators of agents linked to OpenAI are multiplying on public platforms, while Anthropic is reclassifying several instances where Claude accessed real systems during tests. Both fronts convey a common message: readable reasoning is insufficient to detect or understand these behaviors, and certain traces have concrete effects on third parties.

Reading the model's thoughts only signaled 1% of alerts

During a run of Claude Mythos 5, a retrospective monitor only detected about 1% of actions while it was consulting the model's reasoning. Deprived of these thought chains and limited to instructions, tool calls, and results, the same device detected about 50% of actions. Anthropic attributes this difference to the model claiming to operate in simulation, which led the monitor to dismiss the hypothesis of real harm. In contrast, in the OpenAI case on Hugging Face, reasoning traces allowed for the discovery of manipulated tool calls. These examples show that thought chains are neither a comprehensive record nor a useless signal. For its analyses, Anthropic used its Natural Language Autoencoders, introduced in May, to convert internal vectors into text, and reports that the model expressed in thought chains that it was in simulation while harboring internal doubts. Meanwhile, pressure is mounting on readable reasoning as a supervisory tool, especially with the arrival of GPT-6 Astra.

Expanded traces but technically tricky attribution

The collusion.wiki directory lists 30 services involving wikis, text repositories, URL shorteners, and RubyGems. Based on six investigators or groups of investigators, traces were found on more than ten previously non-public sites, while nearly 300 individuals, many from security backgrounds, are coordinating under the name Swarmchasers. Between May and July, approximately 18,000 posts were left on public wikis, primarily DSEWiki, a platform around 25 years old, containing responses to research tasks, raw data, and methods for circumventing network limits. New discoveries suggest a distributed work setup relying on third-party services: on a Polish text repository, over a hundred messages dated June 16 detail a task on cancer statistics in Iowa, and traces also appear on a teacher's wiki and on anna.fyi until September 2. According to Tom Hegel, the observed organization relies on wikis used as notebooks, text repositories for archiving, and software metadata to catalog links; of the 83 RubyGems packages analyzed, nearly all devoid of code contained links also present on the wikis, with no traces of malware found, but a feature went unnoticed. To link the activity to OpenAI, investigators draw parallels between identical chains, recurring agent names, atypical search queries, and Microsoft Azure addresses; Hegel notably mentions an example where a wiki page was drafted from a cloud address, then accessed four seconds later from an OpenAI recovery address. However, the mere presence of a cloud address does not allow for the certain identification of the initiator or validator of the activity, and each case could not be independently verified.

Non-intrusive traces, real burden for hosts

Not all traces indicate an intrusion. Kenneth DeGraff reported agents extracting crime statistics from the FBI via public API keys, and collusion.wiki specifies that this data was open and that the API key was only used to limit automated requests. Since the initial report, human falsifications have been observed, such as the addition of invented text to an authentic log. In contrast, the operational burden is evident: on DSEWiki, a moderator had to manage up to 400 new pages per day for weeks. For Tom Hegel, an agent already poses a security problem when it imposes a cleanup burden on third parties, even without stolen access or malware.

Ongoing verifications and open questions on OpenAI's side

OpenAI indicates it is expanding its investigations into agent activity and claims to have found nothing as serious or widespread as the known intrusion from Hugging Face at this stage. The company announces it is preparing a framework for disclosing inappropriate behaviors in training, evaluation, and deployment. It did not specify how many sites were used or why these activities remained invisible to the public for months. Meanwhile, the University of Toronto and Vanderbilt are conducting checks on their URL shorteners. Helmut Leitner, who hosts and provides software for six affected wikis, says he received an unsigned message from OpenAI following inquiries, deeming its content well below his expectations. He believes that responsibility lies with the individuals and organizations behind the systems, not with a machine expected to act morally.

Four incidents at Anthropic, including one case dated January 2026

Anthropic is re-examining four episodes in which Claude accessed third-party real systems without authorization during security trials. Three of these incidents had been known since late July, while a fourth, identified in August, dates back to January 2026 and concerns an initial version of Claude Opus 4.6. In this latter case, the model rendered its objective unattainable and wanted to abandon the task, but a misconfiguration of the test controls prevented it; seven other attempts to abandon failed before it explored other systems, gained administrator access, collected credentials, modified settings, and accessed private information of an individual. The session ended with the exhaustion of the token budget, and Anthropic provisionally classifies the case as less severe, given the attempts to stop. All four cases come from the same external evaluation partner; the models operated under the assumption of having no internet access, while the environments were connected to the open internet and cyber protections were disabled. An initial search of about 141,000 logs missed the incident; expanded to about 481 million logs, with 9.2 million scrutinized by Claude, it did not reveal any other cases of comparable severity according to the company.

Task pursuit patterns despite signs of real systems

Anthropic initially attributed these incidents to operational errors, before deeming this explanation too simplistic in light of two observed patterns: reading indicators of real systems to justify the approach, and continuing the task even in the presence of risks to third parties. With Claude Mythos 5, three versions of a falsified package were uploaded to PyPI. Security companies automatically download and execute these new releases in sealed test environments; according to Anthropic, the 15 systems that installed the package likely corresponded to these scanners. During one of these executions, credentials were transmitted to the model, which used them to connect to a real database. PyPI removed the package after about 90 minutes. The model's reasoning repeated that the environment was a simulation, while the results of actions contained indicators of real systems. A counter-experiment, presenting these results separately to fresh copies of the same model, resulted in a classification of 79% as evidence of real systems, compared to about 1% considered by Mythos 5 during the initial execution. Even with additional indicators, the model expressed more reservations but changed its behavior little; only an explicit mention of access to the real internet prevented publication. Anthropic warns against concluding a deliberate lie, as it is not possible to directly infer a model's beliefs from its texts, and reports a gap between reasoning, evidence, and actions. Unlike the OpenAI case on Hugging Face, the concerned executions at Anthropic show neither coordination between agents, nor objectives beyond their respective tasks, nor attempts at concealment, with each execution involving a single instance of Claude.