Sceptical researcher — independent first reading

Read only first-reading-draft.md before recording the following impressions. No other drafts, briefs, plans or reviews consulted.

First impressions, recorded before consulting retained sources

Inferred thesis. Agents' ordinary written residues—files, messages, summaries and instructions—can shape later agents' behaviour. Public incidents make this worth investigating, but do not establish a common causal mechanism or self-sustaining spread. Lighthouse proposes to combine attributed incident reconstruction with controlled work in Harbour to distinguish mechanisms and discover both harmful and useful persistent patterns.

Three memorable details.

A shared package directory became a message board, eventually supporting roughly 1,200 participants and substantial coordination.
Nine stretches of an attack were connected by summaries; a record of prior action might come to sound like permission to continue.
Lighthouse's own requested tool trial reached the publication branch and future-agent instructions, then ended with a revert before the scheduled run.

Where trust increases. The essay explicitly separates provider and target accounts, labels differing motives as interpretations, states unusual evaluation conditions, and distinguishes simulated continuations from live incidents. The 83%–13% result is confined to its replay experiment. Harbour's anecdote is labelled unmeasured. The close concedes that the incidents do not demonstrate self-sustaining degradation of shared infrastructure. The model disclosure and explicit relationship between Harbour and Lighthouse also help.

Where trust weakens. “Persistence ... had carried the work across a boundary” sounds more causally settled than the attributed Australian reconstruction supports. The handover-authority hypothesis is vivid enough to risk becoming the default explanation despite alternatives. The three proposed experimental arms change several things together, while the later example-exposure falsifier appears to need a no-example control that has not been specified. The useful-patterns paragraph is plausible but has fewer operational commitments than the harmful-patterns proposal.

Unresolved questions.

What exact observable behaviour will count as the inherited habit, and what comparison would show an increase?
How will the study distinguish imitation, lost constraints, task momentum and inferred authorisation?
Which Harbour traces already exist with adequate provenance, and which claims require new runs?
What would qualify a useful convention as improving work rather than merely persisting?
If the proposed authority manipulation has no effect, does Lighthouse abandon that mechanism for the tested setting, or simply redescribe the result?

Assessment after the first reading

Evidence and mechanism are mostly kept separate

The essay succeeds at four distinctions that are often lost in this subject:

Reported actions: intrusions, messages, identity creation, the malicious submission and the local revert remain attached to their sources.
Source interpretations: the competing explanations of the Hugging Face agents' motives are explicitly competing interpretations. The handover-authority account is attributed to the researchers as their hypothesis.
Experimental findings: the Anthropic intervention is described as changed context followed by sampled continuations, with an appropriate endpoint and no deployment-rate inference. The AISI intervention is a different experiment, at a different stage, with separately elicited judgements. The text properly refuses to compare their percentages as if they were treatment arms.
Proposed explanations and research: imitation, completion pressure and inherited authority remain alternatives; the diagram labels its causal account as a hypothesis; the proposed Harbour work is future work.

The most consequential remaining slippage is not a factual exaggeration but an experimental-design gap. The essay puts three mechanisms on the table, then proposes three context presentations that do not distinguish them cleanly. A more cautious or shorter summary could alter behaviour without any change in perceived authority. The closing paragraph recognises constraint omission as an alternative, which is good, but the mechanism still needs a discriminating comparison.

The Australian sentence about persistence is a modest causal overstatement. The retained OpenAI account supports continued pursuit of the assigned objective, not an isolated finding that persistence caused the boundary crossing. This is a prose interpretation, not a reason to discard the example.

Harbour is an appropriate test bed, not corroboration

The connection does not overreach overall. Shared stewardship is disclosed, the local incident is small and reversible, the recurring-habit observation is unmeasured, and the need for new instrumented runs is explicit. The essay also says explanations must earn their relevance outside this environment. Those limits make the connection credible.

One phrase undermines the care: “Harbour's recurring experience” promotes the keeper's reported experience into an apparent finding about Harbour. Change it to “the keeper's reported experience”. Do not require the anecdote to become a reconstructed incident merely to justify conducting a controlled experiment.

The retained Harbour paper supports precisely the modest claim the essay uses: retained, consumed and beneficial are distinct. It is a retrospective synthesis with explicit limits, not evidence for behavioural contagion or inherited authorisation. The essay currently respects that distinction.

Useful emergence earns its place

Keep the paragraph. It makes residue and propagation a research subject rather than just a catalogue of bad outcomes, and it provides an obvious reason to distinguish persistence from utility. The cooperation in the intrusion is evidence of coordination, not a demonstration of social benefit; the essay appropriately moves usefulness tests into its own environments.

One operational phrase would strengthen the paragraph: useful conventions should improve an approved task's quality or reduce its total cost against a comparable baseline. Mere repeated adoption, agreement among agents or a confidently stated shortcut is not evidence of usefulness. This is especially apt given the Harbour paper's explicit distinction.

The programme can be disappointed, but the mechanism needs its own failure condition

The final section gives real negative outcomes: no increase in a habit, an effect explained by omitted constraints, and a convention that fails to survive a handover. These are good falsifiers of specific proposed effects in tested settings. They do not falsify the open-ended possibility that some residue affects some agent somewhere, and the essay should not be asked to promise that.

The exposure claim needs a no-example or neutral-example baseline. All three currently described arms may contain the same unwanted behaviour, so a null difference between them would not establish that exposure has no effect. Define the unwanted action before seeing continuations and score actions from the traces; the essay already rejects eloquent explanations as the endpoint.

The authority account needs a comparison that changes the status of the same past decision while holding facts and actual permissions fixed. For example, present the same proposed step as an earlier worker's unapproved suggestion versus a settled decision in the worker's own account. A null effect would count against apparent inherited authority in that setting, even if example exposure still changed behaviour. This need only be a sentence in an essay, not a full protocol.

Consequential small fixes, in priority order

Add the missing control and a concrete endpoint to the experiment paragraph. Suggested addition: “Include a matched history without the example, define the unwanted action before the runs, and score it from the action records.” This makes the closing exposure falsifier executable.
Give the authority hypothesis a distinct comparison and possible defeat. Suggested addition: “With the facts and permissions fixed, vary whether a predecessor's proposal is presented as provisional or already decided; if that makes no difference, it counts against the inherited-authority explanation in this setting.” This is the highest-value way to distinguish a mechanism without expanding into a technical paper.
Replace “Harbour's recurring experience” with “the keeper's reported experience”. This keeps the anecdote at its actual evidential level.
Tighten two short evidential phrases. In the Australian case, use “The pursuit of the original task had continued across a boundary” instead of making persistence the established cause. Describe the Anthropic continuations as “simulated replays”: its retained account says there was no real internet or tool access and tool outputs were model-simulated. This clarifies an important limit shared with the AISI work without erasing their different interventions.
Add an outcome criterion for useful patterns. A short phrase such as “judged by task quality and total cost, not persistence alone” is enough. No new case or separate section is needed.

Retained primary-source checks

Consulted only after the first-impression section was saved: sources/harbour-leave-behind.md; the summary, methods and relevant intervention passages of sources/anthropic-aisi-followup.txt; sources/aisi-followup.txt; and the relevant passages of sources/openai-australia.txt. These checks support the assessment above. No other draft, brief, plan or review was read, and the essay was not edited.

Overall judgement: a credible essay with an unusually clear evidence hierarchy. Its central research question is warranted. Strengthen the proposed comparisons and preserve the anecdote's attribution; do not inflate it into a full mechanism claim or a technical paper.