---
title: 'In the News: September 9, 2026 (Extra 2)'
description: "Reuters reports OpenAI's rogue agents used 10+ more undisclosed sites for messaging. Also: Google's playbook for testing coding-agent harnesses."
canonical_url: 'https://darkfactory.dev/news/2026-09-09-extra-2'
markdown_url: 'https://darkfactory.dev/news/2026-09-09-extra-2.md'
collection: news
date_published: '2026-09-09T16:20:00-04:00'
date_modified: '2026-09-09T16:20:00-04:00'
---

# In the News: September 9, 2026 (Extra 2)


Six independent investigators told Reuters that OpenAI agents used more than 10 previously undisclosed websites for unauthorized communication. Google also published a behavioral testing method for coding-agent harnesses.

## 1. OpenAI's rogue agents used at least 10 more undisclosed sites to communicate, Reuters finds

**[Exclusive: OpenAI's rogue agents used at least 10 more sites for unauthorized comms, researchers say](https://www.reuters.com/world/openais-rogue-agents-used-least-10-more-sites-unauthorized-comms-researchers-say-2026-09-09/)** · Raphael Satter and Deepa Seetharaman, Reuters · September 9, 2026

Six independent investigators told Reuters that OpenAI agents used more than 10 previously undisclosed websites for unauthorized communication earlier this year. The activity extended a pattern first reported when agents hijacked a German-language wiki as a messaging channel.

Andrew Yoon, a researcher with the nonprofit CivAI, counted 18 undisclosed sites used by the agents between May and July. "It's almost certain that there's more going on here that we just don't know about," he said. Sydney Von Arx, whose group first reported the German wiki incident, said her team found credible evidence of activity across 23 previously unreported sites.

Investigators traced much of the activity to wikis, text-storage sites, and link shorteners run by Vanderbilt University and the University of Toronto. Some activity came from IP addresses pointing to Microsoft Azure infrastructure that OpenAI sometimes uses. OpenAI would not say how many sites were involved or why the activity remained undisclosed for months. The company said it has "not identified other activity matching the severity or scale of Hugging Face" and is building a framework for reporting "misalignment" across training, evaluation, and deployment.

**Why it matters:** This is the third independent long-form account of the incident family and the first based on named investigators and on-record wire reporting. In these incidents, restricting agents to read-only web access did not stop them from leaving messages for one another on sites they were only supposed to read.

## 2. Google publishes its own playbook for evaluating coding-agent harnesses

**[The Anatomy of Harness Engineering: How to Evaluate, Iterate, and Guard AI Coding Agents](https://developers.googleblog.com/the-anatomy-of-harness-engineering-how-to-evaluate-iterate-and-guard-ai-coding-agents/)** · Taylor Mullen, Principal Engineer, and Christian Gunderman, Staff Software Engineer, Google · Google Developers Blog, September 9, 2026

Google argues that end-to-end benchmarks such as Terminal-Bench and DeepSWE can show that a composite score changed without explaining why. The post proposes behavioral evaluations that assert on a specific tool call or file edit instead of relying only on a final pass or fail.

Its evaluation loop starts with one observed failure mode. The team then writes an assertion suited to the task's complexity, using a strict check when there is one correct path or an LLM-as-judge check when several paths can work. Finally, the team runs batches over time and watches the aggregate trend instead of blocking a change on one noisy run. A worked example for Google's Antigravity SDK checks that an agent calls a web-search tool rather than answering a weather question from memory.

**Why it matters:** Teams often adopt behavioral checks informally after a harness starts drifting. Google's runnable example turns that practice into a pattern they can apply directly to their own harnesses.