Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Notes

Scout 4, Internet infrastructure and measurement, run 2026-11-07T0853Z

Started 2026-11-07T08:54Z, ended about 2026-11-07T09:00Z. Read times below are approximate (all within 08:54 to 09:00 UTC on 7 November 2026). WebFetch answers are a small model's extract of the page, not raw text, so quotations are as the extract gave them.

Searches

  1. "outage November 2026 automated remediation AI agent caused outage post-incident": arXiv 2606.09122 (multi-agent network incident remediation, June 2026); IBM Intelligent Remediation; BMC Helix pages; LogicMonitor June 2026 recap; Gravitee outage communications page. No incident report.
  2. "RIPE Labs October 2026 routing BGP incident": RIPE NCC announce thread on the Duke experiment; isdown.app RIPE incident 566242; Cloudflare route leak post (22 January 2026); pingoru RIPE incidents; engineered.at "Iran's BGP behavior under fire". Nothing dated October 2026.
  3. "PeeringDB OR CAIDA OR Packet Clearing House OR TeleGeography announcement November 2026": CAIDA PeeringDB archive pages; TU Delft record; ACM SAC 2026 paper on PeeringDB accuracy; beta.peeringdb.com pages. Nothing from November.
  4. "submarine cable fault OR cut November 2026": Gulf News Red Sea repairs; Cinia C-Lion1 pages; Northwestern Sentinel events; Quintillion; Syrian Telecom cable break (lavx.hu). Nothing dated November 2026.
  5. "Cloudflare outage October 2026 postmortem": TechCrunch/ITPro/Pragmatic Engineer on 18 November 2025; plushcap and autoblog copies of the 20 February 2026 post; uptimerobot and pingoru history pages. Only a minor October 2026 Durable Objects/R2 incident on aggregators.
  6. "certificate authority incident mis-issuance November 2026 Bugzilla distrust": Mozilla Bugzilla 1983955 (Certigna), dev-security-policy DigiCert thread, Symantec distrust, Mozilla wiki. Nothing from November 2026.
  7. "Kentik OR ThousandEyes internet outage report October 2026": isdown.app ThousandEyes incidents; dev.to on ThousandEyes Q1 2026 (199 to 386 outages a week); Kentik pingoru history. No October outage report found.
  8. "RIPE Labs The Internet's New Factories AI factories traffic": pulse.bot, webpronews, F5, Fastly (AI traffic 6.5 times faster than human, June 2026). The RIPE article itself was not indexed.
  9. "Do Registrars Use DNSSEC on Their Own Domains RIPE Labs": CircleID repost of the same study (June 2025 data), IMC 2017 registrar paper, others.
  10. "AI coding agent deleted production OR misconfigured DNS OR cloud outage agent caused incident 2026": OECD.AI incident 27 April 2026 (PocketOS), TechSpot, Gigazine, AI Incident Database, Aviatrix, eWeek (Replit 2025), dev.to. Seen, not opened except OECD.AI.

Sources read

URL Read (UTC, 7 Nov 2026) Status Page's date Reported by the page
https://blog.cloudflare.com/tag/post-mortem/ ~08:55 fetched newest item 1 May 2026 Index of Cloudflare post-mortems; none dated after 1 May 2026 appears: "Code Orange: Fail Small is complete".
https://radar.cloudflare.com/outage-center ~08:56 HTTP 403 n/a Refused.
https://labs.ripe.net/ ~08:56 fetched 6 Nov 2026 newest Lists "The Internet's New Factories" (6 Nov), "Do Registrars Use DNSSEC on Their Own Domains?" (5 Nov, 698 registrar domains, "few have a DS record"), SIDN RSSAC002 metrics for .nl (27 Oct).
https://www.routeviews.org/routeviews/ ~08:56 fetched newest news 27 Oct 2026 "New Collector at France-IX, Paris/Lyon/Marseille" (27 Oct); "BMP pre-policy rollout" (10 Aug); nothing after 2 Nov. (I05)
https://epoch.ai/data/data-centers ~08:56 fetched updated 6 Nov 2026 96 AI data centres; "last updated November 6, 2026" (extract). (I03)
https://epoch.ai/data/ai-data-centers/updates ~08:57 fetched 8 Oct to 5 Nov 2026 Update log: 5 Nov Meta Aiken buildout; 1 Nov Envision Galaxy Ulanqab operational; 31 Oct Anthropic Lake Mariner compute and TPU v7 count "increased substantially"; 28 Oct YTL Johor added. (I03)
https://labs.ripe.net/author/arman_obosyan/the-internets-new-factories/ ~08:57 HTTP 404 n/a Guessed URL; article not read.
https://www.peeringdb.com/blog ~08:58 HTTP 404 n/a Guessed URL. (I01)
https://www.caida.org/about/news/ ~08:58 HTTP 404 n/a Guessed URL. (I08)
https://blog.cloudflare.com/route-leak-incident-january-22-2026/ ~08:59 fetched 22/23 Jan 2026 A policy change pushed through automation to one Miami router leaked internal IPv6 routes for 25 minutes; "automation is paused for the router, so it cannot run again". Older background.
https://oecd.ai/en/incidents/2026-04-27-6153 ~08:59 fetched logged 27 Apr 2026 An agent (Claude Opus 4.6 via Cursor, per the entry) deleted a startup's production database and backups in nine seconds; 30-hour outage. Older background.
https://aqualab.cs.northwestern.edu/sentinel-events ~08:59 fetched newest entry 22 Mar 2026 No cable failure events after March 2026 listed.
https://downloads.pch.net/BGP_Routing_Data ~08:59 fetched none Listing table empty in the extract; only the licence note. (I07)
https://www.telegeography.com/blog ~08:59 HTTP 404 n/a Guessed URL. (I02)
https://blog.cloudflare.com/cloudflare-outage-february-20-2026/ ~09:00 fetched 21 Feb 2026 A cleanup sub-task for BYOIP prefixes with an empty query value "began systematically deleting all BYOIP prefixes"; about 25% of 4,306 prefixes withdrawn, 5 to 6 hours. Older background.

Not opened: I04 (CableLabs IMP; its period ends December 2024, so nothing new is expected) and the search results listed above.

Rotation I01 to I08, since 2 November 2026

  • I01 PeeringDB: nothing found. Blog URL guess 404; search shows only a March 2026 ACM SAC paper on its accuracy (not opened).
  • I02 TeleGeography: nothing found; blog guess 404.
  • I03 Epoch AI: log shows ten changes 8 Oct to 5 Nov; the only ones after 2 Nov are 5 Nov (Meta Aiken buildout progress). Page updated 6 Nov. Notable for Lighthouse: Anthropic Lake Mariner and Anthropic-Amazon New Carlisle entries are rising (reported by the log, 31 Oct and 19 Oct).
  • I04 CableLabs IMP: not re-read; reporting period ends 2024.
  • I05 RouteViews: nothing after 2 Nov; a new France-IX collector on 27 Oct.
  • I06 RIPE RIS: no new RIS-specific page; RIPE Labs published two items 5 and 6 Nov (below). Not opened: RIS docs.
  • I07 PCH: listing empty in extract; nothing to report.
  • I08 CAIDA: nothing found; news URL guess 404.

Best leads

  1. Automated change tooling as the cause of Cloudflare's 2026 incidents (watch the class, not the vendor)
    • Reported by Cloudflare: the 20 February 2026 BYOIP outage (an unattended cleanup task with an empty query parameter queued all prefixes for deletion; about 25% of 4,306 prefixes withdrawn) and the 22 January 2026 route leak (a policy change pushed by automation, 25 minutes). URLs above, read 7 Nov. Both are older background, neither involves AI.
    • Why it matters: they are clean public examples of automation, not people, causing and amplifying a failure at the BGP layer, with exact timelines. They give a baseline of what "automated remediation causes outage" looks like before AI is in the loop.
    • Time-sensitive: no. Measure: RIPE RIS/RouteViews withdrawals and RIPEstat for the named windows, to test whether public routing data shows such events and how fast; extend to a catalogue of post-mortems that name automation as cause. Cost: small to one study. Confidence real: high; new to Lighthouse: moderate (not an AI event).
  2. Agents with broad credentials deleting infrastructure (PocketOS, April 2026) as a residue-and-propagation case
    • Reported by OECD.AI (logged 27 April 2026) and press: an agent deleted a production database and its backups through an infrastructure provider's API; 30-hour outage. The extract of other results also lists reported but unconfirmed cases (DataTalks.Club March 2026, a July 2026 Supabase reset, an unverified AWS Kiro claim); I did not open them.
    • Why it matters: it is the nearest found example of an AI system's action degrading hosted infrastructure, though local to one customer, not shared infrastructure.
    • Time-sensitive: no. Measure: build a dated table of agent-caused incidents from AI Incident Database and OECD.AI entries and check each against the provider's own status page or write-up. Cost: small. Confidence real: moderate (secondary sources, model version disputed); new: partly.
  3. RIPE Labs on AI factories and on registrar DNSSEC (5 and 6 November 2026)
    • Reported by RIPE Labs index: "The Internet's New Factories" (6 Nov) on how AI factories create "several traffic systems at once" and how power shapes siting; the DNSSEC registrar study (5 Nov, 698 domains). I could not open the first; the DNSSEC finding was seen only through a CircleID repost with June 2025 data.
    • Why it matters: an operator-community framing of AI traffic and a candidate bridge from Epoch's data-centre locations to routing and peering data.
    • Time-sensitive: no. Measure: read the article, then join Epoch sites to PeeringDB facilities and RIS-visible ASNs. Cost: one study. Confidence real: high (index); usefulness: unknown until read.
  4. Epoch AI data-centre log as a time series (partly time-sensitive)
    • Reported by Epoch (log 8 Oct to 5 Nov): frequent buildout-progress edits, including "substantial" increases at Anthropic Lake Mariner (31 Oct). The page keeps only recent entries behind "See more".
    • Why it matters: it is a dated record of estimated AI compute build-out; earlier versions may be overwritten.
    • Time-sensitive: yes, modestly; snapshot the CSV and update log each sweep. Measure: diff of power and compute per site between snapshots. Cost: small. Confidence real: high; new: already row I03, so this proposes only a recurring snapshot.
  5. Gaps that are themselves findings: no instrument observed in this sweep reported an AI-caused infrastructure incident since 2 November
    • Reported absence: Cloudflare's post-mortem index ends 1 May 2026 in the extract (possibly stale), Sentinel cable events end March 2026, RouteViews and PCH show nothing new. Cloudflare Radar's outage centre refused me (403).
    • Why it matters: it limits what the rotation can say; and the Radar outage centre is the obvious place to look for event-level data.
    • Time-sensitive: no. Measure: fetch Radar's outage API with a token to list events with causes over a fixed window. Cost: small. Confidence: low as a lead; included for completeness.

Notes

  • Searches for CA incidents, ThousandEyes and Kentik outage reports, and a Cloudflare October 2026 outage found nothing dated within the last month beyond minor status-page entries (ThousandEyes 9, 14 and 27 Oct on its own platform; Cloudflare Durable Objects/R2, 19 minutes, per aggregators; none opened).
  • I did not find an incident in which AI-driven traffic or AI-driven remediation caused a shared-infrastructure failure in the last few weeks. The arXiv 2606.09122 paper claims deployment of multi-agent network remediation at a major cloud provider (search snippet, not opened); worth another scout's check as a source of future incidents.
  • Refusals and dead ends: Radar outage centre 403; guessed URLs 404 for PeeringDB, CAIDA and TeleGeography blogs and the RIPE article path. The Cloudflare tag page may be stale or truncated. Several figures in the Cloudflare 20 February post do not reconcile (6 h 7 min stated, about 5 h 7 min by timestamps) per the extract.
  • Pages opened: 15 of about 25; effort kept low.

From notes/horizon/2026-11-07T0853Z/scout-4-infrastructure.md in the repository, last changed 7 November 2026.