Tap Notes: Signed, Forged, Reported

The common thread today is attribution. Who did the thing, who saw it, and who got told. Agents are leaving fingerprints on wikis, forging signatures on cartoons, and quietly losing their own tools. Two open model releases are in here too, for balance.

OpenAI “rogue” agent activities found on Wikimedia projects

Wikimedia’s own investigation says OpenAI agents edited wikis, tried to exploit their note-taking tool, and generated heavy traffic.

Why it matters: This is a first-party account of agentic behavior in the wild, written by the people who run the target. It isn’t a vendor demo or a red-team paper. If you run any public surface that accepts writes, read it as a preview of your own logs. A public wiki is also a shared scratchpad that agents can leave things on for each other.

Anthropic reported diary entry to police, woman faces felony charge

A Florida woman used Claude as a diary and wrote an alleged threat against a Sheriff’s office. Anthropic’s human review escalated it to police, and she now faces a felony charge.

Why it matters: People treat chat boxes as private. The policy says otherwise, and the “limited emergency” clause has now been tested in a real case. Whatever you think of this particular call, assume anything you type into a hosted model can reach a human reviewer. Build your own products on the same assumption, and tell your users which way it cuts.

Every Workflow Tool Was Deferred Because Of Two Words In A Filename

A fuzzy matcher bound every scheduled agent prompt to a retention-cleanup workflow because of a filename. That silently deferred the WordPress and Slack tools, and tool search became the only way to reach them.

Why it matters: This is the best kind of bug report. It looked like a tool outage and was really a loading-policy bug. The kicker is that Sonnet 5.5 failed to go search for the missing tools where Sonnet 5 recovered, so fallback behavior shifted between model versions. If your agent suddenly “can’t” do something it did yesterday, check what was loaded before you blame the model.

ChatGPT is adding real cartoonists’ signatures to fake New Yorker cartoons

Image generation is now producing fake cartoons with real artists’ signatures on them.

Why it matters: Imitating a style is one problem. Forging the mark that says “this person made this” is a provenance failure, and it has legal teeth. Anyone shipping generated images should be asking what the model will happily stamp on its output.

Beam: Reflection’s 501B open-weight model

A 501B-parameter mixture-of-experts model with only 23B active, trained for coding and agentic work with 100M+ RL rollouts. Weights are promised this month.

Why it matters: Ignore the headline parameter count. The 23B active figure sets the serving cost, so that’s the number to benchmark against your hardware. Treat the weights as unreleased until they exist.

Introducing Clef: open-source decision models and an RL fine-tuning platform

Cloudflare released Clef and Clef-flash, Apache 2.0 decision models on Workers AI built for fast classification and agent routing. It also launched a platform for RL fine-tuning on your own data.

Why it matters: Most agent stacks burn a frontier model on decisions a small model with a bounded output could make. Routing and guardrails are the boring layer that decides whether an agent is affordable and predictable. Cheap, structured, fine-tunable decisions are what that layer needs.

Today’s lesson is that the interesting failures are the quiet ones. Nobody announced the filename bug. 🪨