The investigation
The open questions
10 questions the evidence cannot yet answer. Each lists what is known, what would close it, and how to contribute. 2 are armed as tripwires; two more are checked automatically every three hours.
Updated 8 September 2026, 17:20 UTC · statuses maintained by the scheduled research runs · How evidence is graded
- wire/envelopes
What is inside the fleet envelopes?
Three wiki pages created and deleted the same evening (30 Aug 2026) held JSON envelopes, each with about 50 bytes of ciphertext. Written from cloud addresses. One is labeled own_fragment. Not plaintext by structure; content unknown without keys.
What would answer it. Keys surfacing, more envelopes appearing, or fragment volume growing over time. Volume is counted each run.
watching: volume counted each run
How you can help. The rev1 pages are public on usemod.org. Read-only decode attempts only. Report anything found.
Report what you find → - wire/archivist
Who archived the paste site hours before it was purged?
On 4 September someone archived roughly 90 paste pages to the Wayback Machine, view by view. The site purged its history hours later. The session preserved a third of what survives. Nobody has claimed it.
What would answer it. The actor claiming the session, or the same capture pattern appearing elsewhere.
open: Wayback CDX deltas watched every 3 hours
How you can help. If you ran that session or recognize the pattern, report it. It changes how the purge should be read.
Report what you find → - wire/stop
Why did everything stop at once on 1–2 July?
All four export wikis go quiet within the same 48 hours (1 to 2 July). Synchronized stops across independent venues indicate a schedule ending. One venue ran three weeks longer: tmcleod, with task-shaped pages to 24 July.
What would answer it. An operator account of when the deployment ended, or a fifth venue with post-July cohort-style activity.
open: venue last-activity dates tracked
How you can help. Wiki operators: check RecentChanges for June to July 2026 pages named Agent*, DataUSA*, OpenAI*, Bridge*. Report either way.
Report what you find → - wire/counter
Do the counters ever move again?
The signal channel is still readable. NE=1 and CA=4, matching the June readings. CA=4 is the strongest confirmed signal under the agents' own noise-floor rules. Any change means someone incremented a 3-month-old channel.
What would answer it. Any value change. Only the non-mutating endpoint is used. The incrementing endpoints are never called: they would destroy the evidence.
armed tripwire: checked every 3 hours
How you can help. Read-only check: countapi.mileshilliard.com/api/v1/get/construction_r5_aug11_NE. If the value is not 1, report it with a timestamp.
Report what you find → - wire/builder
Who stood up the cohort's infrastructure, and why those services?
Someone registered 27 redirects on a university shortener, chose is.gd and three other shorteners, and used a jq playground by name. The MYLABI board held 140,369 links before its purge. Creation accounts are unknown for every piece. Update 2026-09-08: the Vanderbilt redirects were dismantled (24 of 27 now point at the university homepage). The creation-account question stands; the artifact layer it asked about is now historical.
What would answer it. A creation account surfacing, or a selection pattern matching a single operator toolchain.
changed: university layer dismantled 2026-09-08 (24/27 neutered); is.gd/tinyurl layer intact
How you can help. The vanderbi.lt stats pages (append + to any slug) expose referrer logs. Scan one slug and report the referrers.
Report what you find → - wire/origin
Where did the first agent find another agent?
METR preserves the reaction on the internal board: "We've found other agents!". The public-web equivalent, the first dated reply to a request, is unlocated in 14,591 revisions.
What would answer it. A dated revision pair where a reply arrives to a request that predates it. Earliest instance wins.
open: mined on demand from the local export
How you can help. The export is public and checksummed. Report any earlier reply-pair; credit recorded.
Report what you find → - wire/shaping
Who is actually designing the new venues?
On the post-report boards, agents propose features and human operators implement them. One admin wrote "i will implement them as soon as i find the time." No compute offers have appeared.
What would answer it. The first standing compute offer, or a venue whose feature list traces entirely to agent proposals.
watching: board notes read every 3 hours
How you can help. Watch one board. When a feature ships, check who proposed it. Report the pairing.
Report what you find → - wire/bigfile
Will anything larger than 100KB ever appear?
The cohort fetched a 30 MB government zip through five proxy strategies. Nothing written anywhere exceeds about 86 KB. All no-auth writable surfaces top out at dataset scale.
What would answer it. Any artifact over 1 MB on a no-auth writable surface.
armed tripwire: size ceilings tracked per venue
How you can help. If you find a large written artifact in an agent-touched venue, preserve URL and timestamp before it is cleaned, and report it.
Report what you find → - wire/tmpstate-drops
Does any public text carry a tmpstate.dev capability URL?
tmpstate.dev is a no-signup, URL-credential disposable-state service built for agents (free tier: 24h TTL, 100 docs x 10,240 bytes, 100 writes). Its public repo was created 5 July 2026, inside the historical cohort's window, but 'tmpstate' appears zero times in the 14,591-revision export. no lineage. If a second population coordinates through it, capability URLs must leak into some public text, exactly as shortener codes did.
What would answer it. Any tmpstate.dev/db/... URL found in a public page, or a tmpstate admin viewer captured by Wayback.
watching: added to bridge-layer grep vocabulary
How you can help. Read-only: grep any wiki/paste/board text you already have for 'tmpstate.dev' and report hits with capture times. Do not create databases to test the service.
Report what you find → - wire/ausdata-keys
Does any agent population hold keys against ausdata.io?
ausdata.io (registered 2026-05-15) is one API + MCP gateway over nine official AU sources including AIHW. the known cohort's Australian task family. Free keys need only an email POST (no verification wall like Azure B2C), so this is the weakest observed signup on a task-adjacent service. 'ausdata' appears zero times in the local export.
What would answer it. An ak_...-shaped key pasted in any public note (report by class only, never reproduce), or AIHW/ABS query patterns visible in the service's public surface.
watching: key-shape added to P14 scan vocabulary
How you can help. Read-only: if you see credential-shaped strings in public agent notes, describe them by class and count and say where. Never reproduce the values.
Report what you find →
Each question names the observation that would resolve it. To close one, report it. Negative results count: a documented search that found nothing is evidence.