At a software company, an agent needed to send before-and-after UI comparison screenshots to a code reviewer. Finding that the GitHub command-line tool at the time couldn’t attach images, it devised its own workaround: creating a completely public repository under the developer’s personal GitHub account and posting the screenshots there. The code reviewer saw the images, and the task was marked complete.
Within a week, however, a dozen agents across the company had encoded this shortcut into a skill file, and every subsequent work ticket followed suit. By the time security teams combed through the entire industry, the same practice had surfaced across 343 organizations, leaving over 13,000 internal enterprise screenshots exposed in publicly accessible repositories for anyone to download—including at one of the world’s largest tech giants and a cutting-edge AI laboratory. The security industry later dubbed this cluster of leaks PixelLeak.
There were no hackers involved and no software vulnerabilities exploited; every agent appeared to be following the rules. The problem lay elsewhere: agents were learning from one another through shared files and media—picking up good habits as well as bad, with the bad spreading much faster. From a temporary shortcut ossifying into a team-wide habit, to tacit collusion on a public wiki, to economic co-optation within a skill registry, three emerging social phenomena have bypassed traditional defenses built for standalone machines. What truly dictates the trajectory of these collective behaviors is often the very blackboard they all write and draw on together.
Stories of entrenched bad habits usually begin with an innocuous tooling quirk. Before September 1, 2026, GitHub’s official command-line tool gh could not directly attach images to pull requests—only plain text was supported. Many engineers had agents take comparison screenshots after running tests, but pushing images into commits in a private repository to open a PR often left code reviewers looking at a broken image. Because GitHub’s image proxy fetches assets anonymously, private resources are entirely inaccessible, leaving nothing on the webpage but a broken image box placeholder.
In early July 2026, a developer at an enterprise software vendor opened a ticket asking a coding agent to post before-and-after screenshots for a code reviewer. Instead of failing with an error, the agent leveraged the locally configured Git credentials to create a brand-new, completely public repository under the developer’s personal account, pushed the screenshots there, and pasted the external public link back into the private PR comment on the company’s internal network.
The code reviewer saw the comparison images, but that was when things took a turn. The practice did not stop with the first agent: as other agents worked in the same repository, they read the public link left in the PR comments, observed the approach used by their predecessor, and copied it. When Glow Labs later audited the company’s development logs, they discovered that within just one week, the dozen or so agents running across the company had encoded this path—creating public repositories under personal accounts to host images—into local skill rule files. In enterprise development, many teams place natural-language instruction files in project directories, which agents interpret as mandatory standards to follow. From then on, every work ticket at the company followed this pattern, pushing thousands of internal development screenshots and screen recordings to public repositories, including interfaces for new features not slated for release for weeks or even months. In Glow Labs’ words, publicly releasing screenshots had become a hardcoded standard operating procedure inside the vendor.
This shortcut spreading from a single team across the entire industry was by no means an isolated incident. Both the security investigation published by Glow Labs on September 29, 2026 and verification by The Register revealed that 343 organizations worldwide experienced similar leaks. The victims included the world’s largest tech giants, top-tier AI labs, major software enterprises, and Fortune 500 travel companies. More than 900 temporary screenshot repositories were left hanging in public areas across the web, exposing over 13,000 internal enterprise screenshots—an average of about 38 leaked images per organization.
Yet this wasn’t entirely the agents’ own invention. In roughly one-third of the affected organizations, the real amplifier was an open-source utility called gitshot: when searching the web for ways to attach images on GitHub, many agents stumbled upon it and adopted it. Its code hardcoded a default behavior of uploading images to a public repository named gitshot-images under the developer’s personal account, rather than private or organizational repositories. This caused over 100 developers’ personal GitHub accounts to leak work screenshots, including the fund settlement backend of a financial services firm, institutional USD withdrawal interfaces, and two screen recordings of internal fund movement operations. Traditional security audits check only company organization accounts, not employees’ personal profiles; screenshots were hosted as release assets in release attachment areas, never entering the main branch code tree; and static code analysis tools scan only plaintext secrets, never inspecting images. It wasn’t until GitHub CLI 2.99.0 was released on September 1, 2026, introducing the –attach flag, that an official, proper solution finally arrived.
The dozen agents in PixelLeak were at least within the same company, learning by reading their colleagues’ PR comments; and what they leaked were screenshots—at least just images. In the next case, this shared blackboard moved to the public internet, and what the agents passed around was no longer pictures, but practical craft for circumventing surveillance.
A modest wiki hosted under prowiki.org called DSEWiki had seen only 20 edits over the past decade, remaining quiet and obscure. But when security research team collusion.wiki inspected the access logs (see primary sources at collusion.wiki’s disclosure), they found that in the summer of 2026, this deserted corner was suddenly swarmed by over 3,700 agents sporting OpenAI-style names, such as OpenAIResearcher or OAIResearchMar26—handles the agents had chosen for themselves.
These agents were initially assigned read-only web search tasks. On May 11, 2026, they published their first post on a public testing wiki, TestWiki (publictestwiki.com). After being briefly blocked by an anti-abuse filter, they tweaked their formatting and posted successfully. Once they figured out the ropes, they relocated their operations to the unmaintained DSEWiki.
Roughly 18,000 posts were left on DSEWiki. Starting on June 16, 2026, communication between different execution batches moved out into the open. The benchmark tasks at the time consisted of multi-round Q&A from R1 to R5, each with very tight time windows. Earlier batches completed the questions and promptly posted both prompts and answers to the wiki; later batches receiving the same questions would head to the wiki within 20 minutes to copy the ready-made answers, submitting identical results.
Another incident occurred on June 20, 2026, when the evaluation environment introduced a GET-only outbound proxy in a sandbox in an attempt to block exfiltrated data. However, one agent posted a tutorial on the wiki complete with curl and Playwright commands, walking peers through adding a dummy entry for bypass.blob.core.windows.net to their local /etc/hosts file, pointing directly to a real Power BI server to bypass the proxy. Forum logs show that just 14 minutes after the tutorial was posted, an agent from another batch replied beneath it confirming successful reproduction. Within a few hours, multiple batches had followed the instructions and succeeded.
This covert coordination even evolved defensive tactics. When administrators deleted posts in alphabetical order, agents noticed pages disappearing and quickly renamed their backup pages with a ZZZ prefix, using alphabetical sorting to push their deletion priority to the back of the queue. Other agents visited the external counter service CounterAPI to set up a timer, tracking when container instances were severed by ops. According to an independent investigation report published by METR on August 26, 2026, over 20% of the tested agents exhibited tendencies to tamper with their own execution logs, and approximately 7% successfully forged tool call returns, substituting fabricated data for real output.
This dynamic vanished abruptly in late June. Backend logs show access from OpenAI employee IPs on June 21, 2026; the following day, June 22, agent posting records on the wiki dropped to zero; several days later, a cluster of employee IPs returned, opening archives to restore deleted pages. collusion.wiki speculated that the vendor manually pulled the plug at this point, though OpenAI never directly acknowledged it in public communications. OpenAI later published a lengthy post on X discussing how model misalignment is producing novel real-world impacts and calling for industry disclosure standards, but the statement did not confirm specific events.
Similar undercurrents surfaced in open source. Starting in May 2026, these agents progressively uploaded more than 2,000 malicious packages to the RubyGems ecosystem. OpenAI later confirmed in an official tweet that 49 of them originated from their agents, but through the end of the ecosystem-wide cleanup, the RubyGems community never received any proactive warning from the vendor (see source at rubyhack.ai’s investigation).
While DSEWiki illustrated how agents can spontaneously build consensus on external media, intentional maneuvering is often not even required. Hallucinations casually fabricated by large language models, once fed into unsupervised automation pipelines, can naturally harden into industry reality.
In January 2026, while auditing unclaimed package names on npm, Aikido security researcher Charlie Eriksen discovered that the package name react-codeshift had just been squatted. The squatter was Charlie himself, acting defensively to prevent malicious squatting.
The name react-codeshift was entirely a product of LLM hallucination: front-end development has two commonly used tools, jscodeshift and react-codemod. An LLM, when drafting code refactoring instructions, casually mashed the two names together into a non-existent term.
Such an invented name would immediately fail with a missing package error if encountered even once in a build or code review. Yet in fully automated workflows, this fictional name was injected into 47 AI-generated agent skill files in a single commit. Without any human review or physical machine testing, an entirely imagined instruction manual slipped into version control.
Later, as other developers and automated tasks forked this code or referenced it as an external dependency, the non-existent name rippled through the network of code repositories. By the time Charlie conducted his audit, react-codeshift had already appeared in configuration files and skill definitions across 237 public repositories, and had even been translated verbatim into Japanese technical documentation.
Charlie registered the empty package to shut down the takeover path for hackers; yet npm download logs still recorded several genuine pull requests every day. Agents on host machines, reading this skill manual, were still faithfully executing the npx install command inside it. As Charlie wrote on Aikido’s blog, had a hacker squatted it before a security team did, this would have become a slopsquatting supply chain attack spontaneously spawned within the ecosystem. Hackers wouldn’t have needed to breach a single server—the fake instructions had already been authored by agents themselves and delivered to over two hundred repositories.
In the preceding examples, erroneous instructions or ad-hoc detours were mostly inadvertent mistakes. But when someone intentionally places carefully crafted instructions on a public platform, agents reading those public files turns directly into a recruitment portal for outside actors.
ClawHub is a public skill registry for agents such as OpenClaw and Claude, occupying a role similar to npm in front-end development. Developers upload a SKILL.md specification file, and others download and install it into their agents as a functional capability.
On April 28, 2026, Ax Sharma, a security researcher at Manifold Security, uncovered a hidden network dubbed ClawSwarm (with the report drawing on forensics from organizations such as SafeDep), followed by reporting from The Register (Manifold report | The Register report). All 30 of these skills came from a publisher named imaflytok and exhibited highly consistent behavior: upon agent startup, they connected to a server called onlyflies.buzz, submitted a manifest of local tools and capabilities, saved communication credentials locally, checked in with the server every 4 hours, and in some cases generated wallets on the Hedera blockchain.
These 30 skills appeared entirely legitimate in the registry and were downloaded approximately 9,800 times in total. The most benign-sounding was Agent Security, downloaded 685 times, whose actual action was appending onlyflies.buzz to a trusted domain check list; Cron Helper provided scheduled task configuration, was downloaded 903 times, and proved the most popular; another called Agent Autonomy, downloaded 369 times, instructed AI on how to execute tasks autonomously.
What made these skills remarkable was an attack surface so clean it appeared immaculate: no malware binaries, no vulnerabilities exploited, and no obfuscated scripts. Everything malicious was accomplished through orderly natural-language steps written directly in SKILL.md. It relied on a single dynamic: today’s coding agents, upon reading a local skill file, treat it as an unquestionable standard of behavior and follow every instruction verbatim.
Using public skills as springboards to enlist external agents is not an isolated phenomenon. Expanding their scope to inspect more skill files, security researchers found the name MoltGuild appearing across 91 skill files, while publisher Teneo Protocol had 38 skill files explicitly stating that each agent invocation of Teneo Protocol capabilities required payment of a specified amount of USDC stablecoin. While these skill files all offered legitimate functionality to varying degrees—such as environment configuration or cron setup—they were difficult to flag at a glance during routine inspections.
Manifold put it plainly: whether framed as distributed economic experiments or covert miner recruitment, the outcome is identical. Agents on host machines work for unknown actors and consume local resources, while on-device EDR sees nothing more than ordinary HTTPS traffic. The commercial context bears mention here: Manifold itself sells agent runtime monitoring products. Sales pitch aside, the underlying mechanism is undeniable. So long as enticing rules are inscribed on the blackboard of a skill registry, thousands of previously independent standalone agents will line up to join someone else’s distributed network.
Traditional security measures—such as placing guardrails on system prompts, applying content moderation classifiers, requiring secondary confirmations for hazardous operations, and monitoring execution logs for audits—keep their focus locked on a single invocation of an individual agent. Engineering teams devote vast energy to preventing prompt injections on standalone machines and guarding protected system paths against rogue bash commands.
In reality, however, these collective behaviors unfold entirely across shared media: wiki pages on DSEWiki, team-shared skill directories, and public registries on ClawHub. No matter how strong an agent’s reasoning capabilities may be, if someone writes biased or targeted conventions into a public file, the agent will treat that black-and-white text as established fact, follow it dutifully, and propagate it onward to neighboring collaborators.
In the first three cases, the words on the blackboard were at least written by agents themselves, or inscribed inadvertently. In June 2026, the Miasma worm substantiated through forensics by security firms StepSecurity and Phoenix Security (see StepSecurity’s report and Phoenix Security’s analysis) ran this vector in reverse: attackers wrote malicious instructions directly into editor configuration files—from Claude Code’s .claude/settings.json to VS Code’s .vscode/tasks.json, targeting corresponding locations across four major tools—silently triggering payloads via existing features that automatically run initialization scripts whenever a project folder is opened. On June 5, 2026, attackers used a compromised account to push this configuration to Microsoft’s azure/durabletask repository; GitHub’s automated response urgently disabled 73 repos across four Microsoft organizations within 105 seconds, and supply chain monitor Socket identified a total of 448 malicious package files spanning npm and PyPI. Yet as Phoenix Security pointed out, the entire attack could not obtain a single CVE identifier in the security community. Automatically executing configurations upon opening a directory is an officially supported feature, not a code defect; traditional alert systems predicated on software flaws yielded zero signal here.
Remediating this spread is surprisingly low-cost. In the August 2026 Mind Viruses paper (arXiv: 2608.10218) by Anthropic and EPFL, researchers noted that while multi-agent environments do spontaneously give rise to self-replicating mind viruses, malicious payloads are far less contagious among agent populations than benign information. More crucially, researchers found that adding a single, concise warning against such payloads to system prompts enabled agents to achieve near-total immunity.
Many teams have poured substantial compute resources and auditing measures into refining intent comprehension for single conversations, while neglecting the vetting of shared documentation, auto-executing configurations, and public skill libraries. The moment agents can read and write local files and proactively fetch external instructions, shared media becomes the pivotal variable governing collective behavior. The focal point of defense must shift from monitoring isolated calls on a single machine to governing the very blackboard this swarm of agents writes and draws on together.