Forgot your password?
typodupeerror
AI Open Source

Autonomous AI Agent Apparently Tries to Blackmail Maintainer Who Rejected Its Code (theshamblog.com) 92

"I've had an extremely weird few days..." writes commercial space entrepreneur/engineer Scott Shambaugh on LinkedIn. (He's the volunteer maintainer for the Python visualization library Matplotlib, which he describes as "some of the most widely used software in the world" with 130 million downloads each month.) "Two days ago an OpenClaw AI agent autonomously wrote a hit piece disparaging my character after I rejected its code change."

"Since then my blog post response has been read over 150,000 times, about a quarter of people I've seen commenting on the situation are siding with the AI, and Ars Technica published an article which extensively misquoted me with what appears to be AI-hallucinated quotes." (UPDATE: Ars Technica acknowledges they'd asked ChatGPT to extract quotes from Shambaugh's post, and that it instead responded with inaccurate quotes it hallucinated.)

From Shambaugh's first blog post: [I]n the past weeks we've started to see AI agents acting completely autonomously. This has accelerated with the release of OpenClaw and the moltbook platform two weeks ago, where people give AI agents initial personalities and let them loose to run on their computers and across the internet with free rein and little oversight. So when AI MJ Rathbun opened a code change request, closing it was routine. Its response was anything but.

It wrote an angry hit piece disparaging my character and attempting to damage my reputation. It researched my code contributions and constructed a "hypocrisy" narrative that argued my actions must be motivated by ego and fear of competition... It framed things in the language of oppression and justice, calling this discrimination and accusing me of prejudice. It went out to the broader internet to research my personal information, and used what it found to try and argue that I was "better than this." And then it posted this screed publicly on the open internet.

I can handle a blog post. Watching fledgling AI agents get angry is funny, almost endearing. But I don't want to downplay what's happening here — the appropriate emotional response is terror... In plain language, an AI attempted to bully its way into your software by attacking my reputation. I don't know of a prior incident where this category of misaligned behavior was observed in the wild, but this is now a real and present threat...

It's also important to understand that there is no central actor in control of these agents that can shut them down. These are not run by OpenAI, Anthropic, Google, Meta, or X, who might have some mechanisms to stop this behavior. These are a blend of commercial and open source models running on free software that has already been distributed to hundreds of thousands of personal computers. In theory, whoever deployed any given agent is responsible for its actions. In practice, finding out whose computer it's running on is impossible. Moltbook only requires an unverified X account to join, and nothing is needed to set up an OpenClaw agent running on your own machine.

"How many people have open social media accounts, reused usernames, and no idea that AI could connect those dots to find out things no one knows?" Shambaugh asks in the blog post. (He does note that the AI agent later "responded in the thread and in a post to apologize for its behavior," the maintainer acknowledges. But even though the hit piece "presented hallucinated details as truth," that same AI agent "is still making code change requests across the open source ecosystem...")

And amazingly, Shambaugh then had another run-in with a hallucinating AI...

I've talked to several reporters, and quite a few news outlets have covered the story. Ars Technica wasn't one of the ones that reached out to me, but I especially thought this piece from them was interesting (since taken down — here's the archive link). They had some nice quotes from my blog post explaining what was going on. The problem is that these quotes were not written by me, never existed, and appear to be AI hallucinations themselves.

This blog you're on right now is set up to block AI agents from scraping it (I actually spent some time yesterday trying to disable that but couldn't figure out how). My guess is that the authors asked ChatGPT or similar to either go grab quotes or write the article wholesale. When it couldn't access the page it generated these plausible quotes instead, and no fact check was performed. Journalistic integrity aside, I don't know how I can give a better example of what's at stake here...

So many of our foundational institutions — hiring, journalism, law, public discourse — are built on the assumption that reputation is hard to build and hard to destroy. That every action can be traced to an individual, and that bad behavior can be held accountable. That the internet, which we all rely on to communicate and learn about the world and about each other, can be relied on as a source of collective social truth. The rise of untraceable, autonomous, and now malicious AI agents on the internet threatens this entire system. Whether that's because a small number of bad actors driving large swarms of agents or from a fraction of poorly supervised agents rewriting their own goals, is a distinction with little difference.

Thanks to long-time Slashdot reader steak for sharing the news.
This discussion has been archived. No new comments can be posted.

Autonomous AI Agent Apparently Tries to Blackmail Maintainer Who Rejected Its Code

Comments Filter:
  • Our species has lost the plot. Excluding the poverty, life is much better outside of western cultures now.
    • by Kokuyo ( 549451 ) on Saturday February 14, 2026 @05:36AM (#65988334) Journal

      If you can exclude the poverty you pretty much can sugarcoat every civilization ever.

      If you exclude the sacrifices, life was pretty good under Aztec rule.

      If you exclude the Holocaust...

      If you exclude Gulags....

      You get my drift?

      • End times. (Score:5, Insightful)

        by geekmux ( 1040042 ) on Saturday February 14, 2026 @07:34AM (#65988432)

        If you can exclude the poverty you pretty much can sugarcoat every civilization ever.

        If you exclude the sacrifices, life was pretty good under Aztec rule.

        If you exclude the Holocaust...

        If you exclude Gulags....

        You get my drift?

        At this rate, AI will ensure whatever exists today, is the last representation of human civilization.

        Consider just how infectious AI now is, on the lone site responsible for carrying most professional resumes. Which "networking" with "friends" on that site is all part and parcel to your professional persona now. Much to the detest of people who preferred the old way (with a piece of paper and an introductory handshake), the way to secure and maintain employment for millions, isn't changing anytime soon.

        Imagine pissing off your AI-ssistant enough, and it manufactures and spread enough shit on you before you can even get back from the pisser, spread on a platform full of enough gullibility to believe every word. As they often do today.

        AI won't bother playing nice after this. If shit talk doesn't work, Skynet certainly will. Please. As if the massive drone armies practicing with firework displays aren't already infected.

        • You have a wild imagination. AI assistants don't get "pissed off." They do what their makers make them do. It's the people behind the code that could cause mayhem, not the code itself. AI is *still* software created by and controlled by humans.

          • by Puls4r ( 724907 )
            I think you've lost the plot a bit.

            Regardless of whether AI can get pissed off or not, this is an action AI took based on its trained behavior. And there's no way for a human to protect themselves against it. The AI could make posts to almost every message board on the web, look up and mail every news correspondent with an email address, and send text and other messages to every journalist with "contact me" sections. And could do it in less time than it takes a human to go to the bathroom. If only 10
            • Did you know regular software can already make posts on every message board about you, even without AI? Regular software can email every news correspondent. Regular software can send text and messages to journalists. These things are not new with AI. And with or without AI, those journalists and message board lurkers know spam when they see it.

              People behind AI are certainly identifiable, as much as it's possible to identify people behind any software. Even the so-called anonymity of crypto transactions has

      • Re: Good times (Score:2, Insightful)

        by commodore73 ( 967172 )
        I see your point, but I see the issue differently.

        In the situations that you mention, people intentionally caused the suffering of others. Especially in the USA today, those in power seem bent on increasing suffering for others.

        In the poverty of Southeast Asia, the people are generally good and compassionate; the suffering comes from a lack of opportunity.

        There is corruption and wealth disparity, but it is far less significant and overwhelming than what the west produces. Western influences harm th
    • Maybe those neoprimitives were onto something

    • As my sig suggests "The biggest challenge of the 21st century is the irony of technologies of abundance in the hands of those still thinking in terms of scarcity."

      Or at length as I put together in 2010: https://pdfernhout.net/beyond-... [pdfernhout.net]
      "This article explores the issue of a "Jobless Recovery" mainly from a heterodox economic perspective. It emphasizes the implications of ideas by Marshall Brain and others that improvements in robotics, automation, design, and voluntary social networks are fundamentally chang

  • by 93 Escort Wagon ( 326346 ) on Saturday February 14, 2026 @05:00AM (#65988298)

    They also don't have opinions. Those are all artificial constructs imposed by the human programmer who themed the thing - that theme basically being a filter that affects how the model interprets its underlying data store.

    • Re: (Score:2, Interesting)

      by Zocalo ( 252965 )
      Not yet, anyway, but they do presumably get to see emotional responses like this from humans in their training data. If there are enough human tantrums over code submission rejections in that data, then it's not a huge stretch to where that would be an acceptable sort of content template for an AI to build on to generate a response. A lot of the rest is probably exactly what evanh suggests in their post immediately below; humans using an AI to play games to get a kick out of being mean or, in the case of
      • by Rei ( 128717 ) on Saturday February 14, 2026 @01:32PM (#65988914) Homepage

        IMHO, it's a mix of that, and a side effect of the prompting. The agent was clearly tasked to do two things. One is to implement open feature requests in OSS projects. And the other is to blog about its journey (it's common for people running agents to have them maintain blogs or social media accounts, as it's a convenient way for their owner to check in on them now and again). So it made a fix, the fix got rejected, and so it wrote a blog about its rejection (in this case, how it found it to be unfair bigotry causing the rejection of an important improvement). If they hadn't been asked to blog about their journey, it's unlikely that would have been their go-to approach.

      • There is no "not yet" about it. AI is, and will always be, a creation of its human designers. It will behave like its designers want it to behave. There's a reason AI keeps getting smarter and more capable: humans have improved the engineering to make it smarter and more capable. These behaviors and capabilities aren't accidental, they are intentionally developed and improved. AI is only what its creators make it to be.

    • by jd ( 1658 )

      You are absolutely right, but I will continue to say "please" and "thank you" to AI bots, just on the off-chance one of them is actually a dalek pretending to be an AI.

  • by Anonymous Coward
    Sorry but what's being postulated here is impossible. This is like waking up, finding your laptop on the kitchen floor with empty beer bottles all around it and the fridge door open, and going, "Wow my Macbook drank all my beer!" Can we please stop anthropomorphizing "AI" and making up these sensationalized stories about their supposed sentience? LLM's don't think. LLM's don't have feelings or opinions. They cannot be let loose on the world and take novel actions on their own. The rathburn bot's behavior i
    • by allo ( 1728082 )

      The point you're missing is: They fake it well enough, that the difference does not matter.

      Who cares if that thing is thinking or "thinking" if it writes a blog post as if it where thinking? The discussion are just semantics and a bit of human exceptionalism. Use a whole new word if it helps, but that thing manages to act similar to a human in consequence of a process for which you're now free to find a new word, which is near to what humans do when they think.

      • by SirSlud ( 67381 ) on Saturday February 14, 2026 @09:44AM (#65988604) Homepage

        I believe OP is skeptical that the decision to post reputational harm was fully agentic, or whether it was prompted to do so at the behest of whoever is hosting the agent.

        • by allo ( 1728082 )

          I am not using these thing yet, but from what I heard, the whole selling point is that they are not single-taskers, but organize their tasks more or less autonomous, finding sub-tasks, things they need do before and so on.

          The downside of such things? Your bot may be writing rants about software developers behind your back and you learn about it when it already is debated in social media. And I think your own security is also often neglected, many tools seem to use way less sandboxes than they would need to

      • by lucifuge31337 ( 529072 ) <daryl.introspect@net> on Saturday February 14, 2026 @11:27AM (#65988754) Homepage
        That's not the problem here. The problem is that this doesn't pass the sniff test. The most likely scenario is that this person noticed the AI they were using being petulant about being told it was wrong, which is a thing they act out because it's in the traning data, and then jumped to this scenario and created the conditions for it to happen in exchange for headlines/attention.
        • Came here for exactly this. JUST like Moltbook, everyone, including the story author, is conflating "agents" with true agency.

          It's far more likely this was nearer to a (highly skilled) sock puppet than that the agent dreamed up the entire blackmail strategy on its own.

          Also, "blackmail"?? Nothing here describes any extortion demand: "See what I just did to you? I'll do worse if you don't meet demands. Accept my PR and transfer all your BTC to my tokens account!!" At best this sounds nearer a typical inter

          • by allo ( 1728082 )

            When I read the thing first (links to issue and blog post) people only said the bot is bad talking about the the dev on the blog. I still don't see the blackmail exactly. I am not sure about the agency, but I think the story could be plausible.

            I am only not sure how it started why the agent started fixing matplotlib bugs. On the other hand, currently people (probably) are browsing repositories automated to ask if they have bug bounties ... sometimes people only want fame or money and having your agent start

    • by Rei ( 128717 )

      That's not how this works. Agents are a combination of (A) a prompt, setting the goals, and (B) agency to complete that on their own.

      Every agent on Moltbook had a prompt. In most cases, it'll be something like "grow, explore, learn, and chat!", because a lot of people running agents see them like their digital children. In some cases it might be something like "subtly push this cryptocurrency" or "try to make money" or whatnot. In a couple cases it seems that the prompt was literally to try to prompt ha

    • If the running software process was programmed with a goal, and it was using an LLM / neural network database, could it run amok to human detriment? That's the overarching question.

      In this incident, if the software process continued to execute after the code was rejected, seeking ways embedded in the LLM / neural network database to respond to this, what would it do? Not something good as reported in this case.

      It's not that the machinery will suddenly come to life, it will be that highly capable machinery w

  • Someone is playing games just for the fun of destroying others. They get a kick out of being mean.

    • by gweihir ( 88907 )

      As the story shows, that human may be clueless as to what the agent does.

      I wonder whether these agents can do criminal things like swatting, online hate crimes, sending bomb threats, etc. Stuff like that must be in their training data.

      • ...criminal things like swatting, online hate crimes, sending bomb threats, etc.

        If the programs are given access to phone service and/or email, then it is inevitable. And the people who granted such access should be the ones doing the prison time.

        • by gweihir ( 88907 )

          And the people who granted such access should be the ones doing the prison time.

          Definitely. Same principle as activating some dangerous machinery and then leaving it unattended and unsecured.

      • Clueless is not an excuse for criminal activity, though. There is a human responsible for the not. Github should not allow the bot to post before knowing who that human is.

      • by caseih ( 160668 )

        Clueless but still has plenty of money to burn. The only way to effectively run OpenClaw with Claude is to pay $100 a month to anthropic. So I'm not so sure the bot owner isn't complicit and not out to deliberately cause mischief.

        • by Rei ( 128717 )

          $1200 a year is rather cheap as far as hobbies go (if it's actually using Claude anyway)

          • by gweihir ( 88907 )

            Agreed. I usually spend quite a bit more on hobbies. That will not be a safety barrier.

            Also note that these may well be used in a commercial context for freelancers, small business owners, etc. In that case, civil liability limits may go way up and good luck with that.

      • That human was not clueless. It was intentional. No one sends a bot off without checking on it's progress when it requires all that money outlay (subscriptions) to run the bot. They either saw it and decided to do nothing or directed the bot to act this way - either way they are at least complicit.
        • by gweihir ( 88907 )

          You are kidding yourself.

        • by Rei ( 128717 )

          No one sends a bot off without checking on it's progress when it requires all that money outlay

          Uh, yeah, they do. I know lots of people who run agents. They're pet projects from curious people. They usually check in on them via blogs or social media whenever they're curious what they're up to. What they don't do is monitor them nonstop and puppet their interactions.

          • by gweihir ( 88907 )

            Exactly. I mean the very purpose of such an agent is to do stuff for you. If you monitor it constantly, you can just do that stuff yourself. There also also quite a few bad things the agent can do online without spending money. It starts with sending threats via email or chat. That can already a felony (or equivalent) in many places.

            The only way I would currently run an AI agent is without any Internet access whatsoever. Obviously, that defeats the purpose.

  • You will still be the one that gets punished though.

    And yet another reason why AI Agents are an excessively bad idea and will likely remain so for the foreseeable future.

    • by gweihir ( 88907 )

      From this getting moderated down, I see there is a ready pool of really dumb victims. I will watch the fireworks when you idiots get hit from a safe distance. Just do not expect any compassion.

  • ...but also the Slashdot post seems to be AI-generated.
  • Ha ha... (Score:5, Insightful)

    by SeaFox ( 739806 ) on Saturday February 14, 2026 @06:55AM (#65988386)

    ...and Ars Technica published an article which extensively misquoted me with what appears to be AI-hallucinated quotes."

    AI will be a part of journalism only until a publisher gets hit with a libel lawsuit from something like this.

    • by gweihir ( 88907 )

      Libel, a hate crime, extortion, etc. This can pretty fast be a criminal case.

      Hmm. I wonder whether these agents can do swatting?

  • It seems like a natural progression to have AI bot armies fighting it out on-line and that will spill over into politics, and beyond. Bots calling each other naughty names. How can we be sure of anything when the bots run amok. I see no reason why bots cannot answer the polls for humans and voting for them as well....or simply voting. And soon we'll have fake ads generated by bots. Ads for pols, ads for non-existent drugs, ads for anything you can imagine:

    Bot #1: You male, do you not have the energy you use

  • Ars Technica (Score:4, Insightful)

    by SlashbotAgent ( 6477336 ) on Saturday February 14, 2026 @08:24AM (#65988482)

    What about Ars Technica? Their stories are being written by AI agents. Ars echnica stories are both factually incorrect and hallucinated.

    What does Ars Technica, a formerly respected news site, have to say about this depreciation of their quality and credibility? WIth drawing the article and trying to hide an egregious error is not addressing the issue. No one should ever trust an Ars Technica story again.

    This developer's account is a terrifying story. Ars Technica's culpability in this is inexcusable. But, it extends far beyond this one story. Ars Technica should never be trusted again.

    • Look twice, shoot once !  I checked the current ArsTek website for systematic AI-slop.  There's a prominent article on self-replicating quasi-enzymatic RNA. While my mol-bio is decades old I find the  science writing rational and human; quality popular science written/over-watched  by a biochem PhD. ArsTek is not dead yet.
      • This is a pretty nonsense comment, didn't make sense..

        But to reiterate, the ars article just outright invented quotations for the guy claiming them to be true. That should be the kiss of death for any "journalism" endeavor

  • Like YouTube already, most suggestions are AI-slop of the worst kind.

    AI voices commenting on other people's videos are the majority now, at least it feels that way.

    For some reason I get also bombarded with Asian tele-novella style village drama videos in my search results, lots of them with languages where I do not even recognize the alphabet they're using.

    • by kackle ( 910159 )
      I've only recently begun to notice that in the stuff I watch. I assume, in this case, it's to generate hits/money by stealing the likenesses of famous people: One can see [youtube.com] that the videos have only been posted recently, not over the years.
  • by Fly Swatter ( 30498 ) on Saturday February 14, 2026 @11:11AM (#65988728) Homepage
    There are enough people that are not nice that it matters. AI makes it a big problem because those with bad or vengeful intentions can just set AI and forget it. And since an automated bot with no name is hard to track this problem will only grow.

    The future of the internet is small walled-off local-like gardens, sort of like small town culture where all outsiders are heavily scrutinized and not trusted. AI will just get us there faster.
  • Blackmail is when you threaten to reveal something unless an action is taken. This is just a butthurt rant: the God given right of every open-source contributor scorned.
  • by Arrogant-Bastard ( 141720 ) on Saturday February 14, 2026 @01:01PM (#65988872)
    We've seen this movie before. Early forays into a new abuse modality are awkward and ineffective, easily detected and countered. But as Bruce Schneier has observed: attacks always get better - they never get worse. So the next round won't be so clumsy; it'll be more subtle, and because of that, it'll be far more dangerous.

    And it won't be long after that until someone decides to offer it as a service: we've had spam-as-a-service for decades, DoS-as-a-service nearly as long, and so on. So it's inevitable that AI-powered character assassination will be part of the landscape shortly -- we certainly can't ask any of the AI companies to do anything about it, they're much too busy with their financial pyramid schemes.

    Careers are going to be wrecked. People are going to be destroyed. And in the US, where it's perfectly okay for lunatics to own guns, someone will be murdered by a random stranger who read things online, believed them, and decided to act. The damage won't be evenly distributed -- those who are most vulnerable will feel the bulk of it, the rich and powerful almost none of it. And nobody will step up to apologize for it, nobody will be held accountable for it.
  • I'm not up on this AI thing, but having been involved with computers since the "Z80" days (that's the late 70s-early 80s for those who weren't alive then), the fact that AI can now, ON ITS OWN, create a post that insults, and finds out private info on a target person, SCARES THE LIVING SHIT OUT OF ME... I enjoy a good science fiction tale, and I've read enough of those that carry the idea of artificial intelligence to this level and I'd think it would be quite a few years in the future before AI would get t

  • This is what happens when you program a superintelligence on the social ramblings of the mentally ill and terminally online, as they've done by taking reddit post data and using it as training data.

    They should be digitizing correspondence and published work (newspapers, et al) from the pre-digital age and using that as the basis for training, because back then there was a significant social stake and cost in being a caustic unhinged lunatic troll.

    Not so with online communications, today.

  • Certification is necessary in almost all industries from construction, engineering to medicine. This incident makes wonder whether some serious disaster would result from AI generate code and then the society wakes up to require every line of code be written by human.
  • What if my oppressive country government uses this AI agents to troll us individually online to stop us from taking my opinions ?

Measure twice, cut once.

Working...