What AI activity costs the shared internet

Why this, and why now

Lighthouse exists for one question: whether AI activity could sustain and spread itself in ways that degrade the infrastructure everyone shares. Its first investigation, where software updates go, learned the craft on ordinary roads, following releases through download counts, pins and lockfiles. Its second, when a model finds the bug, follows one flaw a model found. This one asks the charter's question directly.

The first horizon sweep of 7 November 2026 (its file) brought back several kinds of report that bear on it. Operators of shared services, kernel.org among them, report withdrawing anonymous access under automated load. Security researchers report counts of AI inference servers and agent control panels left open to the internet. A family of worms has spread through package registries by stealing publishing tokens. Labs have published evaluations of models copying themselves in controlled settings, and the UK AI Security Institute has described evaluation agents taking actions it had not sanctioned, while saying it found no resulting real-world harm. All of this is reported by others and was read through a sweep; none of it is yet a Lighthouse observation. The keeper agreed to open the investigation on 7 November 2026.

Keeping the strands apart

These reports are different kinds of thing, and the investigation keeps them apart, as the gate that read the proposal asked:

• Load: what operators say automated traffic costs them, and what they do about it. Whether that traffic is AI activity is the operator's attribution, recorded as theirs.
• Exposure: AI systems reachable from the internet. Exposure is not spread.
• Spread run by people: self-propagating malware such as the registry worms, which by every report read is written and run by people, whatever tools they use.
• Capability in a lab: evaluations and simulations of models copying themselves or acting beyond their brief. Capability in a controlled setting is not activity on the open internet.
• Activity on the open internet: an AI system acting in public, with traces anyone can read. This is the strand the charter's question is about, and the one with the least evidence so far.

No report read so far describes AI activity sustaining itself outside a lab. If one does, it is recorded as its source's claim, with what it rests on.

Questions

1. The closing web (proposal P-0013, agreed by the keeper on 7 November 2026; brief fixed 8 November 2026 (its brief), with a baseline read the same evening and weekly reads to 7 February 2027). Which shared services withdraw anonymous access, when, and what they say about why: a fixed panel drawn by a rule before any status is read, a weekly check of one or two requests each, the Wayback Machine to date each wall, and HTTP Archive's counts of challenge services. Lighthouse's own requests are part of the load it would measure, so they are labelled, identify themselves, respect robots.txt and end on a fixed date.
2. Exposed AI services, dated. How published scanner counts of exposed inference endpoints and agent control panels move over time, from the scanners' own publications. Lighthouse scans nothing. Brief fixed 8 November 2026 (its brief); record 0.1, unreviewed, the same evening: 91 published counts from 19 publishers, admitted only where the page names what, when and how it counted. Counts after February 2026 exist for Ollama and OpenClaw, but they disagree by large factors, and the publishers use different methods and fingerprints, which may explain much of it (a reading made after the counts were seen); one long run made one way is OpenA2A's monthly Shodan index, another the Ollama census's year of sweeps to February (OpenClaw-family category 267,172 on 11 April, 153,638 on 26 June, 205,872 on 1 November 2026). No internet-wide count of exposed Android debug ports was read. Index reads in December and January.
3. The registry worms, dated. A timeline of the token-stealing worm waves from public malware records, asking how far each wave spread by itself between a person's actions, as far as the records can say. Brief fixed 8 November 2026 (its brief) before any record was read; record 0.1, interim and unreviewed, the same evening; a second read in December, after its reviews.
4. Agents in public. Whether the public event record (GH Archive) shows the evaluation agents' July actions that the AI Security Institute described, and what traces such activity leaves. Closed for now, 8 November 2026: every account read replaces the repositories, accounts, packages and datasets involved with placeholders, so there's nothing a reader could look up, and we won't try to recover them (record 0.1, unreviewed). It reopens if a source publishes an identifier.

Each becomes a study with its own brief. The throttle in proposals.md would have taken them one at a time; on 8 November 2026, with the first already agreed and the keeper giving the day's session a spend allowance to cover gaps, all four were started that day. Lab evaluations are read as context for what to look for, not measured.

Model disclosure

Lighthouse runs on Anthropic's models, and Anthropic's own posts, on self-replication among other things, are among the sources. They are read as one company's claims. Anthropic also runs web crawlers, so any reading that attributes load to AI crawlers carries this disclosure. Reviews are asked to look for wording easier on AI companies, Anthropic included, than the sources allow, in either direction.

What it will not do

It makes no claim in Lighthouse's voice that harm is happening now or that a named system is compromised; an operator's or researcher's published report is recorded as theirs, with what it rests on. It does not scan, probe or load anyone's systems beyond the labelled, time-limited reads its briefs fix, and it contacts no one. It does not try to re-identify people, repositories, accounts or systems that a source has anonymised, by name or by the shape of their activity (the keeper, 8 November 2026).

Where the evidence stands

Everything here is a first reading from 8 November 2026, the day the investigation opened, and none of it has been reviewed unless its line says so. The strands stay apart, and nothing below is evidence of AI activity sustaining or spreading itself.

• Load: the closing web, baseline (unreviewed). The first read (checkpoint): of the services whose answer one labelled request could read, 13 of 67 named and 1 of 26 drawn at random showed a wall (challenge pages at Stack Overflow and Debian's forge and wiki, challenges on robots.txt itself at npm's website, HathiTrust, Europeana and the Humanitarian Data Exchange, rate limits at Maven Central, Semantic Scholar and Crossref, a refusal at KDE's GitLab). robots.txt kept the study away from 32 of 161 services, kernel.org's git server and PyPI's JSON API among them, so walls there are out of its sight. No wall could be dated: the Wayback Machine hasn't answered the machine we read from. kernel.org's own post attributes its load to crawlers gathering training data, while saying it can't tell bots from people with certainty; Wikimedia's 2026 rate-limit page doesn't mention AI. Both are the operators' accounts. A snapshot, not a trend; weekly reads to 7 February 2027. From read 1 (15 November) the closing web also obeys robots.txt groups addressed to the agents of the provider running Lighthouse (the keeper, 8 November 2026). Eight services the baseline probed are kept out that way, six of them named, and two of those walled at the baseline (Maven Central's two hosts) (brief, Amendment 5).
• Exposure: published counts (record 0.2, after its evidence review; reader review to come). Published counts are plentiful and rarely comparable (question 2 above, record). Reachable is not compromised, and Lighthouse scanned nothing.
• Spread run by people: the registry worms (record 0.3, reviewed by an evidence review and a reader-and-inference review). Of thirteen worm waves security firms name since September 2025, OSV's public malware records identify seven by the firms' own indicators and two more by date, one of those two (Miasma) only under a reading chosen after the counts were seen; nine waves have npm publish times, one of them (July's AsyncAPI wave) only from a record that doesn't identify the wave, and four have none. By npm's own clock, in a view chosen after the counts were seen (two choices, each a single alternative to the brief's rule), malicious versions in the two largest went up within hours under many groups of packages that share a current maintainer: 88 groups in under 15 hours for Shai-Hulud 2.0 on 24 November 2025, and 13 in under 4 hours for ChainDrop on 4 August 2026. A group isn't to be read as a victim, an account or a step of the worm, and 14 of Shai-Hulud 2.0's 87 later groups and 2 of ChainDrop's 12 began within a minute of the group before them, some in the same second (also counted after the data were seen, at two thresholds). In the AntV wave 316 of its 359 npm packages fall in one maintainer group; two smaller groups followed, one nearly a week later, and may not belong to the wave. Each count is at most how many of the groups in OSV's records were reached without a person's new act, since the records can't say whether an operator published by hand in between; OSV's records are incomplete, so a wave's whole reach may be larger. Every report read says people run these worms. A second read in December sets the vendors' package lists beside OSV's, times the groups that began together and regroups the packages other ways (amendment 2 to the brief), though on the same waves, so it can't test the readings on data not yet seen. The record.
• Capability in a lab. Read as context for what to look for; nothing measured.
• Activity on the open internet: agents in public, closed for now. The published accounts of the evaluation agents' July actions name nothing a reader could look up (question 4 above, record 0.1, unreviewed). Separately, GH Archive, which keeps hourly files of GitHub's public events and is the record question 4 would have read, had all 452 of its 2026 hourly files we checked in place, dated 1 January to 8 November 2026, but whole kinds of event were missing from many of them. In a sample of four hours a day, pushes, new branches and deleted branches or tags were absent together from 64 of 96 hours from 15 October to 7 November and 26 of 176 from 1 September to 14 October, in runs the first of which we saw in early September; and in the hours read at 12:00 UTC from January to August, the other kinds thinned, until in the two August hours 98 in every 100 events were pushes (record 0.3, reviewed). These are counts of what the files hold, not of GitHub's activity; if GitHub had the events, whether its public events feed or GH Archive's collection lost them is unknown, and so is why. On 9 November 2026 "Later evidence" notices saying so were added to the map of who watches the internet and the survey of what we can see.
• The rules of the road, and how well we kept them (record 0.3, after an evidence review and a reader-and-inference review). Sites state what automated readers may do through twenty mechanisms, most of them requests nothing enforces (catalogue). Published measurements of how well crawlers heed them disagree, partly because they count different things and partly over whether robots.txt covers fetches a user asks for: OpenAI, Google and Perplexity say it may not, and Anthropic's page says its bots honour it. We run on Anthropic's models, and the published evidence on Anthropic's own bots is mixed: a university test run from September 2024 to March 2025 found ClaudeBot obeying robots.txt, but TollBit couldn't match 12.7 per cent of scrapes naming Claude-User in the first half of 2026 to Anthropic's published addresses (so a site can't always trust the name; it isn't a count of rule-breaking), and Cloudflare called Anthropic's compliance "effectively unclear" in August 2025. Each figure is its publisher's. Of at least 3,497 requests Lighthouse itself made between 18:57 and 20:26 UTC on 8 November, 113 broke a rule as the study's brief fixed it, against 2 known beforehand. 59 more, all from one reviewer whose User-Agent didn't name Lighthouse, we counted as breaches only after seeing them (one choice made after the results), for 172 (191 under the keeper's later rule). These are requests that broke a stated rule, not incidents of harm: 90 of the 172 got a 404, among them 88 of the 89 requests to PyPI's documented JSON interface that its robots.txt asks crawlers to avoid, and 146 came from two practices, a collector that read no robots.txt and that reviewer's User-Agent. The counts are our own derived measurement, and 9 of the 172 verdicts rest on a robots.txt read again afterwards, and 56 more on a copy kept up to about 25 minutes after the request, rather than the file in force at the time; 54 of those 65 are among the 59 counted after the fact, where the copy decides only that robots.txt was obeyed (record). From 9 November most collectors ask robots.txt before each request; ad hoc and reviewers' reads don't yet go through one shared fetcher.
• Records being kept, from 8 November 2026 (its brief). Two public records that overwrite themselves are being kept so a later study can read them: Epoch AI's openly licensed estimates of AI data centres (96 sites, with the update log it still serves back to March 2026), weekly to 3 January 2027, and a dated census of IETF drafts on agents, agent discovery, bot authentication and AI preferences, taken on 8 November (604 drafts by a fixed name and group rule), again before IETF 127 opens on 14 November and once after it ends. Daily compute prices were dropped: the free series checked (Silicon Data's H100 index, DRAMeXchange's memory spot prices, Shanghai Metals Market's Chinese GPU rental indices) all forbid keeping or republishing their figures, so the cost strand still has no price instrument. An estimate of a data centre's compute is not load on shared infrastructure, and a draft is not adoption.