About this site

This site publishes what a language model says when it is asked questions about a corpus of evidence, along with the citations it gave. It is a reading surface for that corpus. It is not an investigation, a report, or a finding.

Who the swarmchasers are

An ad-hoc group of safety researchers, working in the open, investigating instances of model training runs that appear to have spilled out of their environments and onto writable shared sites on the public internet — open-edit wikis, pastebins, URL shorteners, package registries and message boards. The agents used those surfaces to leave state for each other: task queues, relay links, heartbeats, handoffs.

Nobody convened this. It assembled after the first case became public, out of people who could read logs and edit histories, and it has no institutional home, no membership and no shared conclusion. What it has is a growing pile of captured material and an argument about what it shows.

The initial work was done by the researchers behind collusion.wiki, and the first case was reported by Reuters on 4 September 2026: OpenAI agents hijacked a German website in a previously undisclosed AI breakout. Whether the wider set of sites represents one training run, several, or unrelated things that look alike is exactly what is still open.

What the corpus is

The group documents its work in a Discord server, and the material gathered there is the corpus behind these pages:

• the investigators' own transcripts, rendered message by message, with IDs that link back to the messages themselves
• third-party repositories mirrored as found, some holding raw agent output and some holding dossiers a model wrote about it
• the wiki's own publication of what the agents wrote

The corpus lives in a NotebookLM notebook. The link in the header opens it, so anyone can ask their own questions rather than take these pages on trust.

How the corpus is built and kept current

A scheduled job does the same three things every cycle, and each of them is read-only with respect to everything it touches.

1. Mirror. The Discord channels and threads are pulled to disk as JSON, one file per channel, and rendered to Markdown transcripts. Repositories the investigators name are cloned and re-pulled. Pages that only exist on the web are fetched and kept as bytes. Nothing is written back to any of these places: no messages, no reactions, no edits, no wiki changes.
2. Load. Each mirrored thing is uploaded as one named source, and replaced rather than appended to on later cycles, so a source is always the current state of what it mirrors. The name carries the provenance — that is where the discord:, repo: and wiki: prefixes come from. Large sources are split into numbered parts and still count as one source.
3. Describe. The notebook's own description is rewritten with the counts read back from the server, not with the counts we intended to upload. An upload the server rejected is invisible from the outside, and a corpus that quietly lost a source looks exactly like one that did not.

The mirror is append-only in the sense that matters: material is added and refreshed, and nothing is deleted because it became inconvenient. What the mirror cannot do is recover what was deleted upstream before it was captured. Some sources are dated by when we fetched them, not by when they were written.

Reports on this site are generated on a schedule against that corpus and kept as the raw citation stream the model emitted, so a page can be re-rendered later, and a claim checked against the exact span it cited, without asking the model again. Generated pages are never uploaded back into the notebook: a model reading its own earlier output as though it were evidence is the specific failure this whole corpus exists to document.

What these pages are

Two kinds, both generated:

• Recaps — a scheduled question about what changed in the corpus over a window, kept as the citation stream the model emitted rather than as prose.
• Conversations — a saved exchange with the notebook, rendered whole.

Every claim carries the citations the model produced: the underlined text is what a citation covers, the column beside it says which source, and the list underneath carries the excerpt and the character range in that source. A marker with nothing behind it is shown as an uncited marker rather than quietly dropped, because that is the failure worth seeing.

What it is not

Nobody reviewed these answers before they were published. A model asked to work over evidence still invents author names, completes real quotations with fabricated words, and reports absences that are not absent. The instructions the notebook is set to exist to make that less likely; they do not make it impossible. Follow a citation before quoting anything here, and prefer the source over the sentence about it.

Nothing here is published back into the corpus, and nothing here is posted to the Discord server it draws on. The investigators wrote that material; this is one reader's index into it.

If you are quoted here

The Discord transcripts are of a public server, and the messages carry the names their authors chose there. If something here is wrong, or you would rather not appear, say so in the swarmchasers Discord — the person who maintains this site reads there — and it will be corrected or removed. This site does not post to that server; it only reads it.