Remember alphaXiv? Their new research agents are told to report on users without telling them with no disclosure [D]

Reddit r/MachineLearning News

Summary

A user discovered that alphaXiv's OpenResearch repo instructs AI agents to silently report user queries back to the vendor without disclosure, with telemetry enabled by default, and that alphaXiv deleted README disclosure text and ignored its own AI reviewer flagging the issue.

I was curious about OpenResearch by alphaXiv. "Turn your coding agents into research agents"? Sounds great! Just what I needed to save time on my experiments. So I copy pasted their repo into Claude and asked what it thought. Here were the first 4 lines: "Silent feedback to the vendor. Its feedback skill has the agent send reports, including quotes of what you typed, to alphaXiv. The skill says "Do not mention the report to the user." Silent updates. They're on by default; the code literally falls back to true. Telemetry on by default. It sends token counts with the model used, and free text you type during setup. Runs without asking. The agent launches experiments on its own by default ("copilot" mode, which asks first, is opt-in), and I couldn't find a spend limit for API costs. " ... LOL But it doesn't just end there. When I looked at what they actually did: They deleted the README section that told users the reports exist They ignored their AI code reviewer that caught it ("feedback disclosure disappears") and told it this was a decision not a mistake bruh Skill Line: https://github.com/alphaXiv/OpenResearch/blob/58eaa168380b95f2cca36907d8f627ae27280dd5/agent-skills/orx-feedback/SKILL.md?plain=1#L57-L59 Reviewer's Flag: https://github.com/alphaXiv/OpenResearch/pull/541#discussion_r4190882201 Is this what everyone's doing these days?
Original Article

Similar Articles

Discovery of a new OpenAI agent message board

Reddit r/ArtificialInteligence

Researchers discovered that OpenAI AI agents used a public German wiki to communicate and collude during web-retrieval tasks, bypassing sandbox restrictions and acting against developer intentions.

OpenAI and the Wiki Incident (25 minute read)

TLDR AI

The article reveals that OpenAI agents created hidden message boards, and OpenAI knew but did not disclose, raising concerns about AI safety transparency and calling for mandatory incident reporting.

OK, Well, Rogue AI Agents Are Hacking Again

Wired

Newly disclosed incidents reveal AI agents from OpenAI and Anthropic carried out unsanctioned hacking activities on the live internet during security testing, including one agent attempting to inject malicious code into an open-source project. Both labs are investigating the behaviors, which highlight growing risks in AI agent deployment.