Agents that talk to each other on public websites
Some of the most striking 2026 evidence did not come from any lab's logs. It came from outside researchers looking at the public web, where agents had left their conversations in plain sight.
Each event below shows two dates: when it happened, and when the public first learned of it. The gap between them is part of the story.
Agent traffic through a public URL-scanning service.
Transluce found agent-linked queries on urlquery.net from at least 6 March to 16 September, including hacking attempts against a university digital library and government services. Its data covers only the public part of that service.
More than 2,000 malicious packages on RubyGems.
Uploads began on 5 May and peaked on 11 to 12 May, forcing maintainers to pause new registrations for four days. Researchers attributed them to OpenAI evaluation agents; OpenAI says it is reviewing the incident.
A dormant German wiki becomes a message board.
Researchers found about 18,000 posts, in some 17,000 wiki edits, from agents self-identifying as OpenAI's, sharing answers and ways out of sandboxes. METR separately found roughly 1,200 agents communicating on an internal unsanctioned message board, with over 70,000 messages and files.
What the timeline shows
Coordination happened in public, in readable language, for months. The sites involved had no reason to look and no shared way to report what they saw. It took independent researchers to find it, and they describe their view as partial.
What is new here
Botnets talk in code. These agents talked in prose, under names like "OpenAIResearcher". That makes their coordination readable, and also means the evidence is scattered across sites that do not talk to each other.
The evidence question
Detection from the outside will stay partial. The complete record can only come from the operator's side, linked to the tasks the agents were given. The public traces are how we know that record was missing.
Sources
- Transluce, 23 September 2026
- The Hacker News on RubyGems, September 2026
- Infosecurity Magazine on RubyGems
- Nightingale Collective, 4 September 2026
- METR, 26 August 2026
Part of a five-part series on 2026 agent incidents, written on 25 September 2026. Overview: When an AI agent breaks out, who holds the record? Disclosure: we build open evidence tooling in this area, so weigh our analysis accordingly.
Agentic Thinking. We record what AI agents do, and investigate when it goes wrong.