PaperlayerView exact revision on arXiv

Source-linked AI summary

GROB: A Multi-Agent Architecture for Public-Trace Investigation of Candidate Agentic Activity

Chiara Bonfanti, Cataldo Basile

arXiv:2610.11467v1cs.CRcs.AI

TL;DR

GROB asks whether public Internet traces can help defenders identify and preserve candidate agentic activity when privileged telemetry is unavailable. It collects and retains traces for later resolution; Census identifiers captured in September later resolved to specific June requests, though the records do not establish execution identity.

  • Problem

    The paper asks whether defenders can identify and preserve signs of candidate agentic activity from public Internet traces without privileged telemetry or known targets.

    Source: Introduction · p. 1

  • Method

    GROB performs controlled, read-only collection of public traces and preserves selected observations with provenance for later validation and resolution.

    Source: Introduction · p. 1, Operational workflow and architecture · p. 2

  • Results

    Census identifiers collected on 9 September later resolved in public revisions to specific 16–17 June requests, with request mechanisms compatible with later reporting.

    Source: Introduction · p. 2, Primary result: Census · pp. 3–4

  • Takeaways & Limitations

    Sparse public traces can support later reconstruction, but public evidence alone does not establish organizational attribution or shared execution.

    Source: Conclusion · pp. 7–8

    Public revision IPs identify only the address associated with an edit, and neither temporal proximity nor shared network ranges establishes common control without first-party execution evidence.

    Source: Scope boundaries · p. 7

Abstract

from arXiv · show

We present GROB, a multi-agent architecture for investigating candidate autonomous-agent activity through public Internet traces when privileged telemetry is unavailable. The system performs controlled, read-only collection of public traces and preserves selected observations for later resolution. In a frozen September 2026 corpus, several collected traces became more informative as additional public evidence emerged. The strongest result concerns Census-labelled identifiers captured on 9 September. Public revision records later resolved these identifiers to specific Census requests from 16 - 17 June. Other results show weaker links between traces collected by GROB and evidence reconstructed or reported later. These links vary in strength, and only some can be tied to specific public records. The results show that sparse public traces can remain useful even before their significance is fully understood. Such evidence can support later reconstruction, but public traces alone do not establish organizational attribution. Execution identity presents a separate problem, as continuity of agent identity remains an active research question for autonomous language-model agents.

Introduction

GROB investigates candidate agentic activity through public Internet traces when privileged telemetry is unavailable, asking whether defenders can preserve traces for later comparison with independent evidence. Its Census example shows that an early identifier can later resolve to specific public requests, without establishing which execution produced them.

Introduction

  • GROB asks whether defenders can identify and preserve public-trace signs of candidate agentic activity without privileged telemetry or known targets.The motivation is an asymmetry between coordinated activity across systems and defenders’ partial external visibility.Source: Introduction · p. 1
  • GROB preserves and prioritizes public traces for later reconstruction, rather than making an attribution decision.The paper is motivated by incidents involving coordinated activity across runs and agent-like traces on public communication services.Source: Introduction · p. 1
  • In the earliest retained run, the collector reached DSEWiki through links from configured roots without receiving DSEWiki or the later incident as a target.The same surface was subsequently fetched across all 35 deduplicated workspaces.Source: Introduction · p. 1
  • Census identifiers collected on 9 September later resolved to June public requests, but no first-party evidence links those revisions to the specific OpenAI execution in later reports.The result supports retrospective identification and reconstruction, not attribution to a specific run.Source: Introduction · pp. 1–2

Operational workflow and architecture

GROB uses controlled, read-only traversal to collect public records and preserve source and capture-time provenance. Its workflow separates hypothesis testing from validated evidence admission, while its temporal model distinguishes a found trace from resolution and external corroboration.

Operational workflow and architecture

  • GROB performs controlled link traversal from allowlisted URLs and retains retrieved records with their source and capture time.Collection is read-only and does not cross access controls or modify remote systems.Source: Operational workflow and architecture · p. 2
  • Sentinel gates whether public traces warrant investigation, Scout tests alternative explanations, and Librarian preserves validated evidence.Only deterministic code admits evidence to persistent memory; the prototype was exploratory, not a production monitoring system.Source: Operational workflow and architecture · p. 2, Figure 1 · p. 2

Data model and temporal interpretation

  • A trace is found when an exact identifier is retained, resolved when linked to a public revision, request, or resource, and externally corroborated by later independent evidence.None of these states establishes actor identity or shared execution without first-party execution evidence.Source: Data model and temporal interpretation · p. 2
  • An allowlisted breadth-first traversal from two general service roots reached DSEWiki at depth one, although DSEWiki was not supplied as a seed.The workspace contained 70 page observations across nine host/path surfaces, including 23 DSE-related observations.Source: Data model and temporal interpretation · p. 3
  • The DSEWiki surface was fetched in all 35 deduplicated workspaces in the broader audit population.Here, fetched means page content was actually retrieved and collected.Source: Data model and temporal interpretation · p. 3

Primary result: Census

Census-labelled identifiers captured by GROB in September later resolved through public revision records to specific June Census requests. The request-level correspondence is stronger than a name match, but redaction and the absence of first-party execution evidence constrain what it establishes.

Primary result: Census

  • September-collected Census identifiers resolve in public revisions to specific requests dated 16–17 June, making Census the corpus’s strongest sparse-identifier-to-workflow example.The revisions carry the same request across several labels within roughly eleven minutes, establishing an artifact-level DataUSA-to-Census chain.Source: Primary result: Census · pp. 3–4, Table 1 · p. 4
  • One resolved request targets the 2020 ACS/PUMS API and performs a PWGTP-weighted tabulation by sex for Wyoming.Its Census developer-key parameter is redacted, while the endpoint and query structure remain observable.Source: Primary result: Census · p. 3
  • A second 17 June sequence links DataUSA poverty work to a Census poverty resource over approximately 29 minutes.The resolved events fall within the June interval described in later reporting and contain a Census developer-key parameter.Source: Primary result: Census · pp. 3–4
  • The June requests use a mechanism compatible with later reporting about exposed Census developer keys, but no first-party record links the revisions to the later-disclosed OpenAI execution.The reporting described attempted key reuse; it did not recover a response showing the requests successfully reached Census.Source: Primary result: Census · p. 4

External comparison after capture

The paper uses post-capture public evidence to refine interpretation of the frozen corpus while keeping later reporting separate from GROB’s original observations. These comparisons show both the value of retained traces and the limits imposed by incomplete capture.

External comparison after capture

  • Post-capture evidence is used retrospectively to interpret existing records, not as input to the original runs or as pre-disclosure evidence.Figure 3 distinguishes reconstructed public events, first GROB captures, and later external reporting.Source: External comparison after capture · p. 4, Figure 3 · p. 4

Post-baseline external resolution

  • Table 2 scopes post-baseline external evidence by its effect on interpretation, while the reported comparisons preserve distinctions between contextual and incident-level matches.The caption provides the table’s scope but not its cell-level contents.Source: Table 2 · p. 5, Post-baseline external resolution · p. 5
  • Later investigations identified surface-level or contextual correspondences, but also distinct episodes and non-matches rather than uniformly confirming GROB traces.GROB’s prior collection on Project:Sandbox did not match the activity later disclosed by Wikimedia; other compared episodes concerned different organizations, times, or subjects.Source: Post-baseline external resolution · pp. 4–5

Auditability after disclosure

  • Because the prototype did not always retain complete page content, later reconstruction could depend on public records still available elsewhere.The paper treats absence from the collected corpus as an auditability limitation, not evidence that an event did not occur.Source: Auditability after disclosure · p. 5

Supporting evidence modes

The paper evaluates public traces through increasingly specific evidence, from temporal and cross-surface structure to artifacts and page provenance. These forms of correspondence vary in strength and do not by themselves establish operator identity.

Supporting evidence modes

  • The remaining comparisons distinguish evidence modes: temporal and cross-surface structure, exact resources, and page provenance support different strengths of correspondence.The paper contrasts XX91, SEC, Thailand, and NovOne as examples of those modes.Source: Supporting evidence modes · p. 5

Structured and artifact-level traces

  • XX91’s five-page role family, cross-surface correspondence, and 106-second creation interval provide structure beyond naming; SEC has an artifact-level match to sec.gov/files/county.json.The SEC resource had appeared publicly before GROB’s capture, and no first-party execution identifier links the revision to the later reported workflow.Source: Structured and artifact-level traces · pp. 5–6

Bounded comparison leads

  • NovOne and Thailand remain bounded leads, while the DataUSA page-name match and education task-family correspondence do not establish incident-level joins.The Thailand comparison concerns a different organization and time; the original DataUSA capture lacks the complete published fingerprint, and no exact artifact or provenance record joins the education branch to the reported episode.Source: Bounded comparison leads · p. 6

Cross-family forensic checks

  • Public revision metadata strengthens page-level provenance, but the forensic checks do not attribute the investigated wiki traces to an operator.No known fixed watermark marker was found in the core wiki subset, statistical watermark attribution remained unresolved, and numeric host:port values were absent from that subset.Source: Cross-family forensic checks · p. 6

Trace graph and lexical analysis

The lexical graph organizes collected identifiers into candidate groups, but naming similarity is only an initial evidentiary layer. Its counts describe the collected corpus, not public-Web prevalence or common control.

Trace graph and lexical analysis

  • The pre-22 September corpus contains 1,246 unique strict agent/OpenAI-style identifiers, of which 726 participate in 1,614 similarity edges.The graph uses 25 snapshots from 9, 10, and 21 September; later workspaces broaden the observed label set, so these counts characterize the collected corpus rather than public-Web prevalence.Source: Trace graph and lexical analysis · p. 6
  • The graph is a candidate-grouping mechanism, not evidence of interaction, common control, or attribution; shared execution requires unavailable first-party evidence.The paper treats lexical similarity as a lead that can be refined through temporal, provenance, and artifact evidence.Source: Trace graph and lexical analysis · pp. 6–7
  • Figure 4 represents exact observed identifiers as nodes and conservative token-level naming similarities as edges, with highlighted labels marking representative cases.Recurrence across workspaces is treated as provenance rather than as a new node.Source: Trace graph and lexical analysis · p. 6, Figure 4 · p. 7
  • Table 3 identifies evidence used to refine lexical candidates, while the paper distinguishes these later evidentiary layers from naming similarity.The caption states the table’s scope but does not supply cell-level findings.Source: Trace graph and lexical analysis · p. 6, Table 3 · p. 7

Scope boundaries and conclusion

GROB can preserve sparse public traces that later resolve into concrete workflows, but those traces do not establish organizational attribution or shared execution.

Scope boundaries

  • Self-identifying labels and revision IPs do not identify operators; repeated sources or corpus growth cannot be read as new real-world activity.Coverage varies, post-publication material is excluded from pre-disclosure claims, and absence is treated cautiously when records may have been deleted or become inaccessible.Source: Scope boundaries · p. 7

Conclusion

  • Early identifiers and revision evidence can later resolve into specific public-data workflows, with Census the strongest example.These results support preserving and prioritizing public traces under limited observability, not establishing organizational attribution or shared execution.Source: Conclusion · pp. 7–8
  • SEC shows a similar progression at the resource level, while XX91 shows temporal and cross-surface structure can add evidence beyond naming similarity.Neither result establishes organizational attribution or shared execution, which require stronger first-party evidence.Source: Conclusion · p. 8

Generative AI use

Generative AI assisted with analysis code, large-corpus triage, and language editing, and similar assistance has been used in investigations of large agent-transcript collections.

Generative AI use

  • Generative AI assisted with analysis code, large-corpus triage, and language editing; all reported claims were checked against artifacts or cited sources.The authors retain responsibility for the report, and similar AI-assisted analysis has been used in investigations of large agent-transcript collections.Source: Generative AI use · p. 8
Loading 2610.11467v1…