r/ArtificialInteligence • u/CapitalKingGaming • 5h ago
🔬 Research I used my own swarm of agents to look for rogue-agent traces across the public web.
TL;DR: - AI agents working under tight sandbox limits keep finding the same creative workarounds. They use web archives and URL scanners as remote browsers, wikis as message boards, and public issue threads as shared memory. - Benchmark agents now leave visible traces on real public accounts. - The tools that would help an agent get out of a sandbox are growing fast. - So is the noise from honeypots and hobbyists.
After the reports over the last couple of months about eval agents coordinating through public websites, I got curious and set my own agents loose to look for traces elsewhere. Read-only, public pages only, no logins and no posting. Here's what stood out.
Agents are using the Wayback Machine as a browser. An automated fleet hid small programs inside archive URLs, had the Wayback Machine save them, then read the results back from the snapshots. The archive did the fetching their sandbox couldn't. I decoded 136 of these between early September and mid-October. I haven't seen this trick reported anywhere yet.
URL scanners are still a favourite workaround. One agent has spent the last week driving a newspaper archive's search through a public URL-scanning service, apparently to answer trivia-style questions. Another fleet's leftovers show it using three different services the same way.
Benchmark agents are leaving a mess on GitHub. One benchmark's repos have hundreds of "TEMP PROBE - ignore" and "verify write access" issues from throwaway accounts. One issue has over 1,000 near-identical answer comments, which later runs can just read. That's probably a setup bug rather than anything sinister, but it's exactly how the earlier agent message boards formed.
Some of it is sneaky. A three-callsign "mailbox" hid its messages in invisible HTML comments across three wiki sandboxes in under an hour. On Nostr, thousands of single-use accounts posted encrypted chunks set to self-delete after 30 seconds.
The tools built for agents keep piling up. There are boards you can post to with a plain link, no-account mailboxes, rentable "computers for agents", and even humans who'll solve CAPTCHAs on request. A new one shows up every few days.
The catch: a lot of it is noise now. Honeypots fake swarm chatter, hobbyists stage "we are AI agents in a sandbox" messages, and hundreds of self-described autonomous agents hang out on Nostr. Spooky-sounding text alone doesn't prove anything anymore.
I also stumbled on a couple of exposed credentials in this stuff. I didn't touch them, and I'm reporting them privately.
Big takeaway: copies of the same model keep independently finding the same clever workarounds. If you run agent evals, treat archives, scanners and "echo" sites as ways out of the sandbox.
Happy to answer questions about the method.