Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Notes

Scout 1, AI activity on the internet. Run 2026-11-07T0853Z. Started 08:54 UTC, ended about 09:15 UTC.

Note on method: WebFetch summarises pages with a small model, so quotations below are as returned by the tool, not checked against raw HTML. Search results were summaries too. Nothing here is a Lighthouse observation; every claim is "reported by" the page named. I did not check URLs against earlier sweep files (no earlier horizon files were present in the run directory when I looked).

Searches

  1. Cloudflare Radar AI crawler crawl-to-refer ratio October 2026: seomator "Monthly AI Crawler Report: September 2026" (seomator.com/blog/ai-search-optimisation-insights); ppc.land/cloudflare-radar; ppc.land/crawl-to-referral-ratio; softwareseni "the numbers behind ai crawling"; blog.cloudflare.com/crawlers-click-ai-bots-training; blog.cloudflare.com/ru-ru/ai-search-crawl-refer-ratio-on-radar; technologychecker.io robots.txt reports; others. Not opened except the two Cloudflare URLs.
  2. Model Context Protocol server registry malicious incident November 2026: arxiv.org/pdf/2609.14119 ("Same Name, Different Server", silent drift census); cyfirma MCP exploitation report; itnews "First malicious MCP server"; beyondmachines; uvcyber advisory MCP 27MAY26; offseq CVE-2026-44429. None opened.
  3. AI agents autonomous self-propagating threat report 2026 Anthropic OpenAI: novaspivack essay; propakistani 16 Oct 2026; channelnews.com.au; rttnews; enterprisedna Anthropic Sept 2026 threat report; fonearena; theregister 3 Feb 2026 (autonomous attacks not real yet); palisade/netlify page. Opened channelnews and fonearena.
  4. Anthropic self-replicating agents small models household devices Qwen3.5-9B research: bleepingcomputer; channelnews; thenewstack; forklog; tech-insider; thehansindia; developersdigest. Opened bleepingcomputer.
  5. Cloudflare "See the agents, set the terms": unite.ai; technobezz; explainx; groundy; plushcap "age of agents cryptographically recognizing agent traffic". Opened technobezz (403), explainx.
  6. OpenAI threat report October 2026: only openai.com/index/disrupting-malicious-ai-uses and 2025 items; no Oct 2026 report found. Not opened.
  7. Kimwolf botnet Android TV boxes ADB: thehackernews Jan 2026; securityaffairs; securityweek; rescana; others. Not opened.
  8. MCP A2A x402 AP2 volume October 2026: blindpay; dev.to "agent payment wars"; fireblocks; cryptoslate; blockeden; others. Not opened.
  9. AI agents incident shared infrastructure open source forge PR spam 2026: opensourceforu; cryptobriefing; vincentschmalbach; paddo.dev; HF contributions Space; Socket "AI agent lands PRs in major OSS projects"; MapServer list. Opened two.
  10. Imperva Bad Bot Report 2026: community.imperva.com 5 May 2026 post; gracker; betanews; itpro. Not opened.
  11. Fastly OR Akamai AI bots agentic 2026: Fastly Threat Insights; Akamai "Securing the Agentic Storefront" (mfn.se); techradar. Not opened.
  12. OpenClaw Moltbook ClawHub: thehackernews Feb 2026; hackmag; gigazine; opensourcemalware. Not opened.

Sources read

URL Read (UTC) Status Page date Claim (reported by the page)
https://www.channelnews.com.au/anthropic-warns-self-replicating-ai-could-soon-spread-through-smart-home-devices/ 2026-11-07 ~09:00 fetched 15 Oct 2026 Reports Anthropic says small models may self-replicate on household hardware; "we expect a future awash with agents running on all types of hardware".
https://blog.cloudflare.com/ru-ru/ai-search-crawl-refer-ratio-on-radar ~09:00 404 n/a Page not found.
https://www.fonearena.com/blog/492107/anthropic-september-2026-threat-report.html ~09:01 fetched 11 Sep 2026 Reports Anthropic's September threat report: "Human involvement is often limited to selecting targets and reviewing final results."
https://www.anthropic.com/threat-intelligence-report-september-2026 ~09:02 fetched (first 100k of 276k chars only) Sept 2026 Reports scheduled agent fleets (13 agents on a scheduled collection job, GTG-10007), unattended token renewal (GTG-20006) and self-repairing implants: agents "continue iterating on GTG-20006's toolkit until it was undetected".
https://blog.cloudflare.com/crawlers-click-ai-bots-training/ ~09:02 fetched 29 Aug 2025 (older background) Reports training is "nearly 80% of AI bot activity" in July 2025; Anthropic crawl-per-referral fell from 286,930 (Jan) to 38,066 (Jul 2025).
https://www.bleepingcomputer.com/news/security/anthropic-warns-self-replicating-ai-could-spread-to-your-smart-devices/ ~09:04 fetched 13 Oct 2026 Reports the Anthropic experiment assumed unauthenticated ADB and did not demonstrate a full worm; setup took 28 to 51 h (Qwen3.5-9B).
https://blog.cloudflare.com/ (index) ~09:04 fetched listing to 6 Nov 2026 Lists 5 Nov "Agents aren't humans (but they kinda are)", 4 Nov "See the agents, set the terms", 21 Oct Commerce.com/WebMCP: "almost 100,000 Commerce.com domains" offer agents shopping tools.
https://www.anthropic.com/research/self-replicating-ai ~09:06 fetched 12 Oct 2026 Frontier Red Team: "small AI models may be months away from being capable enough to self-replicate"; lists flow-anomaly signals defenders could observe, and cites Kimwolf at over 2 million devices.
https://blog.cloudflare.com/see-the-agents-set-the-terms/ ; /agents-arent-humans-but-they-kinda-are/ ~09:06 404 (guessed URLs) n/a Not found.
https://www.technobezz.com/news/cloudflare-personal-agent-analytics-access-controls ~09:10 403 n/a Refused.
https://www.vincentschmalbach.com/github-capping-ai-pull-request-flood/ ~09:10 fetched 15 Jul 2026 Reports GitHub PR limits count agent PRs: "generated output can scale almost without limit, while the attention available to review it cannot."
https://explainx.ai/blog/cloudflare-personal-agents-analytics-access-policies-2026 ~09:11 fetched 4 Nov 2026 Reports Cloudflare added a "Personal Assistants" category and per-agent policies; names no agents, gives no traffic figures. Primary link given: blog.cloudflare.com/personal-agents-visibility-control/ (not opened).
https://huggingface-open-source-agent-contributions.hf.space/ ~09:11 fetched 30 Apr 2026 Reports 772 transformers PRs; AI-classified PRs rose from ~44/month (Q3 2025) to ~167 (Apr 2026); one issue drew 39 near-identical PRs.
https://github.blog/open-source/maintainers/how-pull-request-limits-are-cutting-down-the-noise/ ~09:12 fetched 18 Jun 2026, updated 29 Oct 2026 Reports merged PRs rose from ~25 million/month (Jan 2023) to over 90 million; "Reviewing one still takes a human about as long as it ever did."

Only 12 pages actually yielded content; the rest are search summaries.

Best leads

  1. Anthropic's self-replication paper: what a replicator would leave in public data. Reported by Anthropic Frontier Red Team, 12 Oct 2026 (https://www.anthropic.com/research/self-replicating-ai), echoed by BleepingComputer 13 Oct. Small models (30B or fewer) may reach end-to-end replication on commodity IoT by end of 2026; the post names observable signatures (multi-gigabyte model transfers, device-to-device flows, scanning) and the Kimwolf precedent. Why it matters: it is the first lab statement that self-sustaining spread could happen outside datacentres, and it states a dated forecast and public indicators, so a baseline can be taken before the forecast date. Time-sensitive: moderately; the baseline must precede end of 2026 (about 8 weeks). Measurable from public sources: exposed unauthenticated ADB (port 5555) counts over time from Shodan/Censys/FOFA summaries or Shadowserver reports; Kimwolf/Aisuru tracker counts (XLab, Synthient); public posts of any in-the-wild small-model agent on a device. Cost: small to one study (baseline plus periodic re-read). Confidence real and new: high that the paper exists; medium that public instruments can resolve it. I did not verify the paper's figures beyond the two readings, which agreed.
  2. Agents as a traffic class: Cloudflare's personal-agent controls (4 to 5 Nov 2026). Reported by Cloudflare blog index and explainx (4 Nov). Cloudflare added a "Personal Assistants" bot category, per-agent allow/block policies, and a 5 Nov post on agents versus human identity; 21 Oct, ~100,000 Commerce.com domains expose agent shopping tools through WebMCP. Why it matters: agent traffic becoming a named, policy-controlled class is the point at which its volume could be counted publicly (Radar categories) and also where agent-held user context begins to flow. Time-sensitive: yes, weeks; Radar series and the Cloudflare directory change, and policy defaults shape future behaviour. Measurable: Radar bot-class series and the verified bot directory (snapshot and diff), robots.txt and WebMCP//.well-known adoption on a sample of domains. Cost: small. Confidence: medium-high (primary posts not opened; the 404s were guessed URLs).
  3. Agent-authored contribution load on shared forges. Reported by GitHub blog (18 Jun, updated 29 Oct 2026), Hugging Face analysis (30 Apr 2026), and a 15 Jul commentary. Merged PRs over 90 million a month; per-repo caps now count agent PRs; one issue drew 39 near-identical PRs; Jazzband reportedly shut down (secondary, unverified). Why it matters: a concrete, documented case of agent output outrunning human review on shared infrastructure, with duplicate-fix clustering as a signature of agents reacting to the same trigger. Time-sensitive: no. Measurable: GH Archive events, PR duplicate clustering by issue reference and bot authorship, adoption of the PR-limit setting where visible. Cost: one study. Confidence: high on existence; novelty medium (it overlaps Python-release and Harbour interests only loosely).
  4. Anthropic September 2026 threat report: persistent, scheduled and self-repairing agent operations. Reported by Anthropic (Sept 2026; only first 100k of 276k characters read) and FoneArena 11 Sep. Thirteen agents on a schedule with no human in the loop; scheduled token renewal; agents rebuilding implants until undetected; 130-day campaign. Why it matters: closest primary description of automated activity that sustains itself by iterating on its own residue. Time-sensitive: no. Measurable: little directly (actors are not public); could map the report's indicators to public artefacts (token renewal patterns, rebuild cadence of samples on MalwareBazaar-type feeds) but with weak attribution. Cost: small (read the rest, extract testable claims). Confidence: high real, low that outside data can test it.
  5. Agent payment and tool-registry rails as quiet infrastructure. Reported by secondary aggregators only (not opened): x402 about 5.1 million transactions and about $274,000 in October 2026; Allium Q3 68.3 million agent payments at about five cents each; CYFIRMA June 2026, nine of eleven MCP registries accepted a proof-of-concept malicious server, about 9,400 servers listed; arXiv 2609.14119 on silent drift in MCP servers. Why it matters: on-chain agent payments are one of the few fully public logs of machine-to-machine activity, and registries are a spreading channel for agent tooling. Time-sensitive: no (on-chain history persists; registry contents change). Measurable: on-chain x402 counts by facilitator, registry snapshots and server hash drift. Cost: one study. Confidence: medium; figures conflict and I could not reach primaries.

Notes

  • Cloudflare Radar itself and the Cloudflare AI Insights page were not opened; the freshest crawl-to-refer figures I saw (Anthropic ~1,917:1 July 2026, Perplexity 296:1 to 2,373:1 July to September, per secondary blogs) are unverified and worth reading at Radar directly. The seomator "September 2026: GPTBot halves" report was not opened.
  • No OpenAI October 2026 threat report turned up; latest seen was 25 Feb 2026. Google, Microsoft and Meta disclosures were not searched for lack of budget.
  • Imperva 2026 (published late April, Thales; ~53% of 2025 traffic automated, per secondary summaries), Fastly (49% bots, AI traffic growing ~6.5x faster than human Jan to May 2026) and Akamai (July 2026, AI bots 47.9% of commerce traffic) are all background and unread at primary.
  • ClawHub/OpenClaw malicious skills (Feb 2026, 341 flagged of 2,857 per Koi) is older background; the reported vector (a skill instructs an agent to post on Moltbook) is a possible spread channel but all uploads were human-made per the summary.
  • Dead ends: guessed Cloudflare blog URLs 404; technobezz 403.

From notes/horizon/2026-11-07T0853Z/scout-1-ai-activity.md in the repository, last changed 7 November 2026.