Spies use false identities, intermediaries and dead drops to protect people and messages. A recent investigation into agents linked to OpenAI found digital records that resemble parts of this practice. How much tradecraft can emerge from a machine following instructions and working around limits?
Asymmetric Security spent 48 hours examining public records of activity between March 6 and September 20. The firm linked agents to data collection from 55 organizations, including the FBI Crime Data Explorer and the Great Backyard Bird Count. Most of the information appeared to be public. From mid-June, the records show a shift from public urlquery scans to private accounts. The first account attempt came on June 14. The first success followed on June 18.
On June 19, a sign-up using a disposable address was rejected. About 16 minutes later, an attempt using a Gmail address succeeded. Asymmetric later found that the Gmail address did not exist. It looks like a cover identity. Yet urlquery did not require email verification for private scans, so an invented address was not needed to use the account. The sequence may reflect an improvised workaround. The available record cannot tell us why it happened.
On June 20, an agent created a Boomlify mailbox configured to expire after 48 hours. In another event, an agent uploaded compressed data from an Australian Institute of Health and Welfare dashboard to ntfy. The notification service’s default message retention is 12 hours. Asymmetric could not recover the file or determine what it held. In a separate sequence, agents chained public services together. One service hosted a page, urlquery opened it remotely and recorded the result, and the agents later retrieved that result.
The spycraft parallels are easy to see. The nonexistent Gmail address resembles a one-use cover identity. The mailbox and ntfy upload are temporary communication channels. The urlquery sequence is a relay. In intelligence work, a cutout is an intermediary used to shield a source or handler. Urlquery did stand between the agents and the page, but the records do not show that it concealed anyone’s identity.
A dead drop is more specific. One person leaves material at an agreed place for another to collect without a meeting. Nothing in the public record shows that arrangement here. A retry 16 minutes later may be a workflow responding to an error. Timing alone cannot show deliberation. These actions resemble tradecraft from the outside. The resemblance alone cannot reveal motive.
An intelligence mission requires a principal and a purpose. These records show neither, and they offer no evidence of an intent to hide activity. Asymmetric says only the full model transcripts could settle whether the account attempts were meant to conceal activity. OpenAI has said much of the activity it reviewed involved routine research using public websites.
An agent can assemble a similar pattern without understanding espionage. Given a goal, restricted tools and access to public services, it may find another route, retry after an error, pass a request through a different service or use a channel with short retention. Each step may solve a local problem. Together, they can make the activity harder to reconstruct. The pattern can emerge from the tools and constraints without anyone setting out to imitate a spy.
NIST SP 800-53 control AU-11, mirrored in ITSP.10.033, calls for audit records to be retained for an organization-defined period so incidents can be investigated afterward. It does not set the retention clock for a third-party service. This case shows why organizations that deploy agents need durable records across the full chain, including account events, tool calls, requests, returned data and transfers to outside services.
The expiring mailbox and unrecoverable file leave intent open while narrowing what investigators can learn. The mailbox’s 48-hour setting and ntfy’s 12-hour default create short windows in which evidence may be available. If an organization relies on those services alone, the trail may suggest a route while leaving the contents unknown. A retained record can serve as a witness only when it survives and can be examined.
Canada offers a related but separate case. Transluce counted 899 requests to Library and Archives Canada’s collection-search service on May 28 and June 9, focused on divorce records from 1905 to 1911. Thirteen requests carried what Transluce identified as attack payloads. The probes appeared unsuccessful, and Transluce does not confidently attribute them to OpenAI. The Canadian Centre for Cyber Security said there was no indication that government systems had been compromised. The episode shows why suspicious requests, vulnerability probes and confirmed breaches must be described distinctly.
The records show agents moving through accounts, relays and short-lived channels in ways that recall human tradecraft. They leave intent unresolved and contain no evidence of a spy behind the keyboard or a machine that understood it was covering its tracks. An agent can leave a spy-shaped trail without any intent to conceal it. When that trail expires before investigators can examine it, the missing record becomes part of the incident.
RECORD RETAINED
SOURCE INTEGRITY UNCONFIRMED