Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH028

The first public attack trace predates the PHP disclosure, but says little about AI use by attackers

The answer so far. The web reader showed Amazon Threat Intelligence's first-party account of an attempted exploit in its MadPot honeypot dated 17 October, with further attempts from 02:00 to 08:00 UTC on 21 October and after the stated 14:00 UTC embargo lift. Amazon says it does not know how the earlier actor obtained the information or whether attempts would have succeeded on real systems [S1]. The direct collector received a Site Unavailable placeholder for this article, so the Amazon text is not independently replayable from retained raw bytes here. Cloudflare's retained page says it observed attack traffic against its customers and changing payloads, but gives no count or rate for this episode [S2]. Neither observation shows a named system compromised or attributes an individual request to AI.

Latest read, 23 October 2026, 16:00 UTC (unreviewed working note). Read the note

Write-up studies/LH028/LH028.md

Checkpoints

The working notes written at each read, newest first. They are unreviewed: a finding reaches a piece only after review.

From studies/LH028/ in the repository, last changed 9 November 2026.