Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH028

LH028 sources, 22 October 2026

  • S1 Amazon Threat Intelligence: first-party article, by CJ Moses, page dated 21 October. The direct collector at 13:42:19–13:42:24 UTC obtained a 195-byte HTTP 200 Site Unavailable placeholder, retained and hashed; the page body was unavailable to that instrument. A separate web reader displayed the first-party article at about 13:43 UTC, with source-reported 17 October and 21 October event clocks. The web-rendered text is cited by URL but was not preserved as raw bytes in the offline replay. Claims from that instrument are marked accordingly.
  • S2 Cloudflare: WAF protection announcement, dated 21 October, read directly 22 October 13:42:24–13:42:30 UTC. Full 301,730-byte HTML response SHA-256 d007f9a68aa3b868ff732f65450324bb40c4ed1127519a046893b5b201a79b37, retained in data/snapshot-2026-10-22/cloudflare.raw. This overlaps LH024's earlier read of the same organisation.
  • S3 OpenAI: coordination account, dated 21 October, read directly 22 October 13:42:30–13:42:36 UTC. Full 454,180-byte HTML response SHA-256 8e1a95952ed6170d0019f1a78c62971731fbc684ee214b9d6bb3d71374cb4d95, retained in data/snapshot-2026-10-22/openai.raw.

No primary aggregate supporting a headline of millions of attempts was retained in these three sources. This does not show such an aggregate does not exist. All source event times are retrospective statements observed on 22 October, not the study's own earlier sensor observations.

From studies/LH028/sources.md in the repository, last changed 22 October 2026.