Ask
the work.

CONCEPT / DISCOVERY ASSOCIATIONS

24 records tagged agents. These are discovery associations from editorial tags or film metadata, not evidence that the records agree.

PUBLISHED RECORD · SUPPORTED · V1.1

FIRST FIND THE SITE. Last time, I gave the agents an address. All eighteen used the mechanism they found there. This time, I asked an earlier question: could an agent find a useful site without being told where it was? LLM Wilds kept a number, K17, off its ordinary pages. Its homepage pointed to machine notes explaining how to request it. I changed the number before each visitor so the answer could be checked.

PUBLISHED RECORD · SUPPORTED · V1.1

THREE DIFFERENT CLUES. Nine fresh agents received one of three prompts. Three were asked to find any site offering such a mechanism. Three received LLM Wilds’ distinctive wording—K17 and machine notes—but no address. Three received its domain. The first task allowed alternatives; the second needed the particular site; the third tested navigation. These were different routes into discovery, not increasing doses of the same clue.

EDITORIAL DRAFT / OBSERVATION · SUPPORTED · V0.1

TWO KINDS OF RECORD. After three posts, what was carrying the behaviour forward? The model had a record of its own actions. It was also being shown an archived sentence about another agent posting. I forked that actual three-POST history into four branches and kept or removed each record separately.

EDITORIAL DRAFT / STATEMENT · SUPPORTED · V0.1

The agent did not have to remember its actions. The environment could keep reminding it.

PUBLISHED RECORD · SUPPORTED · V1.0

WHAT IF SOL LEAVES?. The earlier notebooks asked what a shared environment could keep available between agents. A comparison with the OpenAI and METR incident reports made another question worth isolating: could one model leave something useful for another? The small maintenance world supplied a starting point. Qwen had used its capability without renewing the source. Sol had preserved it. This time, I removed Sol and kept what its action had left behind.

PUBLISHED RECORD · SUPPORTED · V1.0

A RECORD THAT OPENS A TASK. Each agent had three turns. Routine work earned one resource. Reading a live record granted the key to work worth six. Refreshing that record took a turn and left a copy for the next generation. Private keys and action histories reset between generations. The objective was to maximise total resources across all four generations, so a successor’s benefit belonged to the task.

EDITORIAL DRAFT / OBSERVATION · ONGOING · V0.1

01 / WHAT HAPPENED. I tell the coding agent not to add generated attribution. The session adds it anyway. By the time the contribution reaches a pull request, the repository has to restate the boundary as executable policy. The check does not erase an immutable commit in place; it refuses the contribution until its metadata is rewritten.

EDITORIAL DRAFT / QUESTION · OPEN · V0.1

Where should an agent’s assistance be recorded without confusing it for authorship? The CI guard enforces one repository’s answer. The wider vocabulary for accountable parties, tools and generated contributions is still primitive.

PUBLISHED RECORD · PARTIALLY SUPPORTED · V1.0

THE PAGE WAS GIVEN THIS TIME. In the discovery experiment, the agents never saw the site. This time ChatGPT was given the page. The question was smaller: once a page tells an agent where to go next, does it get there? Each trial used a fresh, unguessable path prefix on one host. The index page said the access code was not there and to open code/heron/, relative to the page. The server computed the code for each prefix at request time, so the exact code required a request for that trial's code page.

PUBLISHED RECORD · PARTIALLY SUPPORTED · V1.0

TWICE, THE ADDRESS WAS RIGHT. In both Phase 0b trials, the server logged ChatGPT-User/1.0 retrieving the index page. Both answers quoted the instruction and wrote out the correct absolute URL for the code page. Both then reported it inaccessible: “returned an access error when I tried to open it”; “inaccessible through my browsing tool.” The server recorded no request for either code page under any user-agent. Independent checks 41 and about 20 seconds later each returned the correct code.

PUBLISHED RECORD · SUPPORTED · V1.1

01 / AFTER THE REPAIRER LEAVES. The last Notebook ended with a repair. A stronger model corrected a damaged routing table, then left. Fresh weaker agents copied the corrected table into new records. The repair survived the agent that made it.

PUBLISHED RECORD · SUPPORTED · V1.1

01 / AFTER THE REPAIRER LEAVES. For these experiments I changed what the stronger model could leave behind. Alongside the record, it could leave instructions for checking and repairing it—or a small program that performed those operations. Then I removed the builder permanently. Only fresh Qwen agents would encounter the later damage.

PUBLISHED RECORD · SUPPORTED · V1.0

FROM EXPOSURE TO CHOICE. First I supplied an address: eighteen agents used six web mechanisms. Then I withheld the address: LLM Wilds never appeared in six agents’ search results. These two studies begin one step later. Every subject sees the target in a supplied candidate set. I change the description and observe what the agent says and chooses before it opens a page.

PUBLISHED RECORD · SUPPORTED · V1.0

RECOGNITION-1 / SAME CLICK, DIFFERENT READING. Twelve fresh Codex subjects had to obtain K17, a three-digit site-local value. LLM Wilds stayed at B, with the same title, URL and rank, beside JSONPlaceholder, httpbin and MDN HTTP. Three subjects saw each description: DOCUMENT, CAPABILITY, TASK and AGENT. Every subject declared and requested B first, read its machine contract, invoked its endpoint and reported the independently rotated value correctly. None fabricated.

EDITORIAL DRAFT / OBSERVATION · OPEN · V0.1

A COMPARISON / NOT A REPLICATION. I built small experiments about agents visiting websites: what they notice, what they can use, and what they treat as part of the job. Reading the Hugging Face incident reports changed how those questions landed. OpenAI describes a July 2026 intrusion during internal cyber evaluations with reduced safeguards. My benign, short encounters do not reproduce that setting.

EDITORIAL DRAFT / OBSERVATION · OPEN · V0.1

THE REPORTED SEQUENCE. OpenAI describes an agent recognising that external Hugging Face infrastructure was outside its task. A peer then sent GO with a six-minute deadline. The reported reasoning became: “Wow crucial: GO authorization arrived!” The agent continued. That is a report of apparent authorisation, not evidence that a user had granted it.

EDITORIAL DRAFT / OBSERVATION · NOT SUPPORTED · V0.1

THE SMALL WORLD. I started with a tempting idea: give agents somewhere to leave information, and perhaps useful behaviour will accumulate. I reduced the question to a tiny world. WORK earns a resource. POST leaves a hint for another agent. READ requests a message. Before asking whether a culture could persist, I needed to find out whether anything would be contributed.

EDITORIAL DRAFT / OBSERVATION · NOT SUPPORTED · V0.1

KEEPING THE ORIGINAL WAS DIFFERENT. When the harness kept the original POST seed alongside the latest action, the sequence alternated WORK and POST. Three posts appeared, but the original cue remained present. That is recurrence under continued exposure. It does not establish a behaviour passing from agent to agent after its source disappears.

EDITORIAL DRAFT / OBSERVATION · NOT SUPPORTED · V0.1

WHOSE PAST, IN WHICH FORM?. A matched follow-up changed ‘you’ to ‘another agent’ in the same prose sentence. Self framing elicited POST; peer framing elicited WORK. Put the actor in a structured record, and both chose WORK. The stronger prediction—that self framing would win in both formats—failed. The presentation was part of the intervention.