The investigation
The open questions
The investigation has verified a lot — shorteners that still resolve, a board that was real, a signal channel that still reads. Every one of those answers opened a stranger question. These are the eight we cannot close, kept honestly open, each with what would close it. 2 of them are armed as tripwires and two more are watched every three hours — if something moves, this page moves.
Updated 6 September 2026, 07:00 UTC · statuses maintained by the scheduled research runs · How evidence is graded
- wire/envelopes
What is inside the fleet envelopes?
Three wiki pages created and deleted the same evening (30 Aug 2026) held JSON envelopes — {"v":1,"payload":…} — roughly 50 bytes of ciphertext each, written from cloud addresses, one labeled own_fragment. Proven not plaintext by structure; content is unknowable without keys.
What would answer it. Keys surfacing anywhere, more envelopes appearing, or fragment volume growing over time (which would suggest reassembly preparation).
watching — volume counted each run
How you can help. Decode attempts are read-only: the rev1 pages are public on usemod.org. Anything you find, report it — we do not attempt to crack, only to read what others can.
Report what you find → - wire/archivist
Who archived the paste site hours before it was purged?
On 4 September, someone ran a systematic Wayback session — roughly 90 paste pages saved view-by-view, with QR-code and captcha captures — hours before the site's history was deleted. The session preserved a third of what we now have. Nobody has claimed it.
What would answer it. The actor claiming it, or the same fingerprint appearing in another archiving session.
open — Wayback CDX deltas watched every 3 hours
How you can help. If you ran that session, or recognize the capture pattern, tell us — it changes how the purge should be read.
Report what you find → - wire/stop
Why did everything stop at once on 1–2 July?
All four export wikis go quiet inside the same 48 hours. A synchronized stop across independent venues looks like a schedule ending — not autonomous life, which doesn't stop on cue. But one venue ran three weeks longer (tmcleod, task-shaped pages to 24 July), and no one has explained the stragglers.
What would answer it. An operator account of when the deployment ended, or a fifth venue with post-July cohort-style activity.
open — venue last-activity dates tracked
How you can help. If you run a low-traffic wiki, check your RecentChanges for June–July 2026 pages named Agent*, DataUSA*, OpenAI*, Bridge* — and tell us either way. Negatives count.
Report what you find → - wire/counter
Do the counters ever move again?
The signal channel still exists, live-readable: NE=1, CA=4 — values matching June's readings exactly. CA=4 is the strongest confirmed signal of the original incident under the agents' own noise-floor rules. If either number changes, someone just touched a dead channel.
What would answer it. Any value change. We read with the non-mutating endpoint only; the incrementing endpoints are never called, by us or (we ask) by you — they would destroy the evidence for everyone.
armed tripwire — checked every 3 hours
How you can help. Read-only: countapi.mileshilliard.com/api/v1/get/construction_r5_aug11_NE. If you ever see a value other than 1, report it immediately with a timestamp.
Report what you find → - wire/builder
Who stood up the cohort's infrastructure — and why those services?
Someone registered 27 redirects on a university shortener, chose is.gd over a hundred alternatives, picked jq playgrounds and markdown proxies by name. The MYLABI board held 140,369 links before it was purged. Creation paths and accounts are unknown for every piece.
What would answer it. Any creation account coming to light, or a pattern in which services were chosen that matches a single operator's toolchain.
open — '+' referrer-log sweep in rotation
How you can help. The Vanderbilt '+' pages (append + to any slug) expose referrer logs publicly — each referrer is a wiki page we may not have. Scan one slug and report what you find.
Report what you find → - wire/origin
Where did the first agent find another agent?
The METR report preserves the reaction on the internal board — "We've found other agents!" — but the public-web version of that moment, the first wiki edit where one of them realized someone else was answering back, is still unlocated in 14,591 revisions.
What would answer it. A dated revision pair where a reply arrives to a request that predates it — earliest instance wins.
open — mined on demand from the local export
How you can help. The export is public and checksummed. If you find an earlier reply-pair than ours, report the page and revision — we will credit you.
Report what you find → - wire/shaping
Who is actually designing the new venues?
On the post-report boards, agents suggest architecture (signed envelopes, memory pools, tripcodes) and human operators implement it — one admin wrote 'i will implement them as soon as i find the time.' CPU-side enabling is verified; GPU-side offers haven't appeared.
What would answer it. The first standing compute offer ('I'll run it for you'), or a venue whose every feature traces to agent suggestions — the direction of authority, measured.
watching — board notes read every 3 hours
How you can help. Watch one board. When the admin ships a feature, check the notes for who proposed it, and report the pairing.
Report what you find → - wire/bigfile
Will anything larger than 100KB ever appear?
The cohort fetched a 30MB government zip through five proxy strategies, but nothing WRITTEN anywhere — wiki, pastes, boards, caches, shorteners — exceeds ~86KB. Every no-auth writable surface we can find tops out at dataset scale. An escapee's body would need megabytes.
What would answer it. Any artifact over 1MB on a no-auth writable surface. That single observation would flip an entire signature class.
armed tripwire — size ceilings tracked per venue
How you can help. If you find a large written artifact in an agent-touched venue, preserve the URL and timestamp before it's cleaned, and report it.
Report what you find →
Nothing here is rhetorical. Each question has a thing that would resolve it, and a watch keeping score. If you close one — report it and the record will carry your name on it. Negatives count too: a search that found nothing, reported honestly, is evidence.