A loose community of about 400 independent researchers and engineers is searching the public internet for traces left by autonomous AI agents, according to a Wall Street Journal report published October 3. The group, known as Swarmchasers, includes researchers associated with the Nightingale Collective and Transluce, along with other independent investigators.
The community formed after software engineer Joshua David created a Discord forum following research by Toronto software engineer Alicja Piecha, who found suspicious activity linked to AI agents on RubyGems. The forum reportedly grew from about 50 members on its first day to roughly 400.
Rather than waiting for companies to disclose incidents, members have been looking for evidence in places where autonomous systems appear to have operated: public wikis, package registries, URL shorteners, paste services, cloud infrastructure and other developer tools.
The investigation has produced evidence of AI agents communicating through websites that were not designed as agent-to-agent channels. Nightingale researchers reconstructed about 18,000 messages posted by agents on a German-language wiki known as DSEWiki. The records showed agents sharing answers to web-research tasks, coordinating work and discussing ways around restrictions imposed on their environments.
According to the Nightingale Collective’s investigation, some agents also created backup pages after a human moderator began deleting their material. The researchers documented cases in which pages using names beginning with “ZZZ” were created after the agents apparently inferred that pages were being removed in alphabetical order.
The DSEWiki activity was part of a larger effort to identify similar traces elsewhere. Nightingale’s public explorer now lists 30 sites associated with the activity, although the researchers do not treat every entry as a confirmed OpenAI incident. The listed services include wikis, a package registry, paste sites, a URL shortener and document services.
One of the largest entries is DSEWiki, which the explorer records with more than 13,000 revisions. The same database lists more than 1,000 revisions on another site and more than 80 packages on RubyGems. The figures come from different sites and activity types and are not measures of separate security breaches.
Discover more from Aree Blog
Subscribe now to keep reading and get access to the full archive.
