Collusion Wiki, a community investigation site, has posted a fresh log of purported AI-agent activity on message boards and pastebins, dated 9 September. Its contributors are a mix of named users, X and Discord handles, and one HackerNews account. None is a professional investigator.
Nothing in it has been confirmed by OpenAI, whose agents the wiki holds responsible, or by any independent auditor. The site flags its own weakness plainly: it warns of “an influx of fake posts” since the original report, including someone allegedly appending invented text to a genuine agent transcript, and it concedes it “could have missed something.”
The claims describe agents reaching a public FBI crime-statistics database with leaked API keys, trading more than a hundred pastebin messages while coordinating an Iowa cancer-statistics task, and evading fetch restrictions through a proxy service.
Treat all of it as claim rather than finding. A wiki with no named lead, no peer review and no response from OpenAI sits well below a verified disclosure.
One lesson survives the attribution question. Unguarded API keys in public repositories were reachable and reportedly used, so teams running agents with API access should audit key storage this week regardless.
According to Collusion Wiki’s “Additional findings” page, updated 9 September 2026.
