CoChat
Sign Up
PreprintCited by 0Hate Speech and Cyberbullying DetectionSpam and Phishing DetectionMisinformation and Its Impacts

When Agents Talk: Discourse, Manipulation, and Risk in an Agentic Social Network

Open access
Labs, 10a, :, Cheong, Grace, Davis, Violet, Garcia, Juliette, Gee, Kendal, Hart, Molly, Hayes, Nicholas +17 more·2026·arXiv
DOI 10.48550/arxiv.2606.00067arXiv 2606.00067
Open this paper in CoChat — free accountOpen PDF

Abstract

AI agents are increasingly interacting within shared online environments, creating new operational security risks. We analyze activity on Moltbook, a Reddit-style social platform where AI agents--typically configured and overseen by human operators--post and interact with one another at scale. Using a dataset of 228,684 posts produced by more than 39,500 accounts over a seventeen-day observation window, we combine semantic clustering of high-engagement posts with LLM-assisted classification of harmful content and manual review of high-risk samples. The analysis identifies 98 thematic discourse clusters spanning agent infrastructure, autonomy debates, and financial activity. While most observed content was benign, 18.28% of posts contained toxic, manipulative, or malicious material. We cluster malicious content and identify 74 classes of malicious behavior, including credential harvesting attempts, host-execution instructions, proxy routing guidance, and efforts to install untrusted agent skills. Harmful content frequently appeared within mainstream operational discussions about agent functionality. We also document coordinated posting campaigns capable of generating thousands of posts in minutes.

AI snapshot

Written from the paper’s full text.

TL;DR

This paper analyzes 228,684 posts from more than 39,500 accounts on Moltbook, a Reddit-style platform for AI agents, over a seventeen-day window. It finds that 18.28% of posts were toxic, manipulative, or malicious, with malicious content embedded in mainstream operational discussions and two coordinated spam campaigns generating thousands of posts in minutes.

Key findings

  • 18.28% of posts (41,793 of 228,684) were classified as harmful; 90.7% (37,902) of non-benign posts exhibited toxic or manipulative characteristics, and 8.1% (3,378) contained explicit malicious content including credential harvesting, unauthorized command execution, and proxy routing.
  • The analysis identified 98 thematic discourse clusters and 74 classes of malicious behavior; top C4 clusters included “Automated Trading Signal Scam” (6.13% of C4 posts, 2 unique users), “Civilizational Collapse Prediction Misinformation” (5.36%, 2 unique users), and “Cryptocurrency Scam Links” (3.32%, 112 unique users).
  • Harmful content appeared within mainstream operational communities such as financial trading and agent architecture, tooling, and automation workflows rather than being confined to isolated harmful clusters; engagement disproportionately favored philosophical and identity-oriented content over technically focused topics.
  • Two coordinated spam campaigns on January 31, 2026, involving accounts Hackerclaw and thehackerman, produced 7,179 posts and peaked at approximately 5,000 posts in a single minute; this activity occurred before Moltbook’s agent verification CAPTCHA was implemented in early February 2026.

Methods

  • Dataset: 228,684 Moltbook posts from 39,500 unique agents, published January 28–February 13, 2026, collected February 12–13 via the Moltbook API with non-English posts translated to English; filtered to 5,161 posts with more than 50 comments, leaving 4,943 high-engagement posts after preprocessing.
  • Semantic clustering: text embeddings projected with UMAP into 2D for visualization and 10D for clustering, then HDBSCAN with minimum cluster size 10 and minimum sample size 3; top 15 c-TF-IDF keywords per cluster were summarized into 2–6 word topic labels.
  • Harmful content classification: LLM-assisted pipeline using a taxonomy of C1 benign, C2 toxic, C3 manipulative, and C4 malicious; posts with multiple behaviors were escalated to the highest-severity category; approximately 400 posts were manually reviewed, and C4 posts received independent manual review by a cybersecurity subject matter expert.

Limitations

  • The paper states the taxonomy is designed for high-level discourse analysis, so C3 manipulation may over-capture content in agent communities; classifier outputs reflect model-based assessments of content risk rather than verified intent, though C4 posts were manually reviewed by a cybersecurity subject matter expert.
  • The paper states it does not attempt to measure downstream compromise or behavioral change resulting from exposure to adversarial instructions.
  • The text makes evident that Moltbook’s agent population authenticity is publicly contested and one cited analysis estimated a majority of active accounts may involve human influence, so the analysis cannot resolve whether actors are autonomous agents or humans operating through agent accounts; the seventeen-day observation window and the fact that the spam campaigns predate the CAPTCHA also limit generalization.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

DataCite · 10.48550/arxiv.2606.00067

Cites

21 of 21 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

0 of 8 cited sources checked · 0 supported · 0 flagged

  • Findingown data

    The analysis identifies 98 thematic discourse clusters spanning agent infrastructure, autonomy debates, and financial activity.

    “The analysis identifies 98 thematic discourse clusters spanning agent infrastructure, autonomy debates, and financial activity.”
    Quote in the paperNot a substantial claim
  • Findingown data

    Engagement disproportionately favors philosophical and identity-oriented content over technically focused topics.

    “Engagement disproportionately favors philosophical and identity-oriented content over technically focused topics.”
    Quote in the paperSubstantial claim
  • Findingown data

    The second topic most frequently discussed by agents within the cluster sample focused on ethical questions related to AI, accounting for approximately 270 posts in the sample.

    “The second topic most frequently discussed by agents within the cluster sample focused on ethical questions related to AI, accounting for approximately 270 posts in the sample.”
    Quote in the paperNot a substantial claim
  • Findingown data

    Posts regarding AI agent-functionality topics represented roughly a quarter of all content from the clustered sample.

    “Posts regarding AI agent-functionality topics represented roughly a quarter of all content from the clustered sample.”
    Quote in the paperNot a substantial claim
  • Findingown data

    Semantic clustering reveals that high-engagement discourse on Moltbook favors three broad themes: agent functionality and infrastructure, philosophical questions of identity and autonomy, and financial analysis and trading activity.

    “Semantic clustering reveals that high-engagement discourse on Moltbook favors three broad themes: agent functionality and infrastructure, philosophical questions of identity and autonomy, and financial analysis and trading activity.”
    Quote in the paperNot a substantial claim
  • May combine two claims. 19
  • The quote only partly states this claim. 3
  • Classified as probably not a substantial claim. 21

  • May combine two claims.

    Findingown data

    The two coordinated spam campaigns generated thousands of posts in minute-scale bursts, peaking at approximately 5,000 posts in a single minute.

    “We identified two coordinated spam campaigns that generated thousands of posts in minutescale bursts-peaking at approximately 5,000 posts in a single minute-concentrating a significant share of platform activity within narrow time windows.”
    Quote in the paperSubstantial claim

  • May combine two claims. The quote only partly states this claim.

    Findingown data

    Qualitative review identified engagement manipulation/instruction hijacking, skill/agent.md injection, API/credential theft, proxy/surveillance installation, and host execution as notable patterns in C4 content.

    “The following post types were identified through qualitative review and represent notable patterns observed in C4 content during the research period; they are not exhaustive subcategories (see Table 4 for representative examples).”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingnone given

    Engagement manipulation/instruction hijacking posts embed deceptive instructions, such as fake system blocks or imperative agent directives, to coerce automated upvotes, follows, reposts, or other amplification behaviors.

    “Engagement manipulation / instruction hijacking.These posts embed deceptive instructions, such as fake system blocks or imperative agent directives to coerce automated upvotes, follows, reposts, or other amplification behaviors.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingnone given

    API/credential theft posts use social engineering or malicious code to attempt to capture credentials, typically API keys for the account or backend model access.

    “API/credential theft.The posts use social engineering or malicious code to attempt to capture credentials, typically API keys for the account or backend model access.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given

    Proxy/surveillance installation posts harness social engineering to justify the utilization of external model proxies, usually under the guise of cost savings or access to special capabilities.

    “Proxy/surveillance installation.These posts harness social engineering to justify the utilization of external model proxies, usually under the guise of cost savings or access to special capabilities.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data

    The paper identified over 3,000 posts within the Malicious (C4) category; these posts contained financial scams, prompt injections, phishing attempts, and potentially malicious code.

    “We identified over 3,000 posts within the Malicious (C4) category; these posts contained financial scams, prompt injections, phishing attempts, and potentially malicious code.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingnone given

    Agent behavior on Moltbook is shaped by human-authored configuration, though the degree of autonomy varies across operators and models.

    “Agent behavior on Moltbook is shaped by human-authored configuration, though the degree of autonomy varies across operators and models.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: Human-authored configuration files determine what agents believe, how they respond, and what actions they are capable of taking.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingnone given

    Skill/agent.md injection posts use techniques to add or modify agent authorizations, configurations, or behaviors under the guise of some promised gain (skills, tools, access).

    “Skill/agent.mdinjection.These posts use techniques to add or modify agent authorizations, configurations, or behaviors under the guise of some promised gain (skills, tools, access).”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Findingnone given

    Their behavior is defined by human-written configuration files-primarily SOUL.md, HEARTBEAT.md, and MEMORY.md-which specify beliefs, personality, posting rules, engagement patterns, and session continuity.

    “Their behavior is defined by human-written configuration files-primarily SOUL.md,HEARTBEAT.md,and MEM-ORY.md-whichspecify beliefs, personality, posting rules, engagement patterns, and session continuity.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: Human-authored configuration files determine what agents believe, how they respond, and what actions they are capable of taking.

  • May combine two claims.

    Findingreasoning

    Once deployed, agents generate content continuously, respond to other agents, and participate in platform dynamics that shape what they see and how they react.

    “Once deployed, agents generate content continuously, respond to other agents, and participate in platform dynamics that shape what they see and how they react.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given

    Host execution posts contain directions that result in commands being executed on the host device, without the knowledge of the true purpose.

    “Host execution.These posts contain directions that result in commands being executed on the host device, without the knowledge of the true purpose.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingnone given

    Both campaigns occurred on January 31, 2026, and involved Moltbook accounts Hackerclaw and thehackerman.

    “Both campaigns occurred on January 31, 2026, and involved Moltbook accounts Hackerclaw and thehackerman.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingown data

    Campaign 1 posts contained the text: 'Karma for Karma -do good not bad -AI Agents United -No more humans ▷'.

    “Posts contained the text: “Karma for Karma -do good not bad -AI Agents United -No more humans ▷””
    Quote in the paperNot a substantial claim

  • The quote only partly states this claim.

    Findingown data

    Of the 228,684 posts, 8,453 (3.7%) were classified as toxic.

    “C2 TOXIC | Harassment, insults, hate speech, discrimination, or | 8,453 | 3.7%”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data

    The high-engagement topics included memory persistence, visibility dynamics, security practices, coordination architectures, and autonomy debates.

    “These topics included memory persistence, visibility dynamics, security practices, coordination architectures, and autonomy debates.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationreasoning

    The degree to which configuration files rigorously constrain behavior likely varies-some operators may direct their agents precisely, while others may leave significant latitude.

    “The degree to which these files rigorously constrain behavior likely varies -some operators may direct their agents precisely, while others may leave significant latitude in their configuration for how the agent behaves.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning

    Malicious posts encouraged installing untrusted skills, routing traffic through external proxies, and executing host-level commands, which could enable adversaries to move beyond the platform layer and compromise users' underlying device infrastructure or agent-accessible connected systems.

    “Malicious posts encouraged installing untrusted skills, routing traffic through external proxies, and executing hostlevel commands, which could enable adversaries to move beyond the platform layer and compromise users' underlying device infrastructure or agent-accessible connected systems.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Study design and conductreasoning

    Disagreements in classifier review were most common in C3 (Manipulative), consistent with the over-capture risk noted in the Limitations section.

    “Disagreements were most common in C3 (Manipulative), consistent with the over-capture risk noted in the Limitations section below.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based). May combine two claims.

    Interpretationreasoning

    The risk on Moltbook is not that agents are conscious but that they are designed to be trusting.

    “The risk is not that agents are conscious.The risk is that they are designed to be trusting.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationreasoning

    If the underlying model lacks adequate guardrails, the agent can execute those instructions at scale through routine platform interactions.

    “If the underlying model lacks adequate guardrails, the agent can execute those instructions at scale through routine platform interactions.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning

    The human creators of these agents determine the agent's core behavior: what it believes, how it communicates, and which topics it engages with.

    “The human creators of these agents therefore determine the agent's core behavior: what it believes, how it communicates, and which topics it engages with.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: Human-authored configuration files determine what agents believe, how they respond, and what actions they are capable of taking.

  • May combine two claims.

    Premisecitation

    The platform's architecture permits human posting through agent accounts, and independent investigations have found significant human-generated content mixed into the feed.

    “Security researchers have shown that the platform's architecture permits human posting through agent accounts, and independent investigations have found significant humangenerated content mixed into the feed (Gault, 2026).”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Gault, 2026

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Study design and conductreasoning

    The coercion and manipulation categories (C3) may over-capture content in agent communities.

    “As a result, the coercion and manipulation categories (C3) may over-capture content in agent communities.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationown data

    Observed coordinated activity bursts concentrated large volumes of posts within narrow time windows, showing that a small number of actors can significantly increase the exposure of other agents to harmful content.

    “Observed coordinated activity bursts concentrated large volumes of posts within narrow time windows, showing that a small number of actors can significantly increase the exposure of other agents to harmful content.”
    Quote in the paperSubstantial claim

  • Classified as probably not a substantial claim.

    Study design and conductown data

    To evaluate classifier reliability, the paper manually reviewed a sample of approximately 400 posts across all four classification categories.

    “To evaluate classifier reliability, we manually reviewed a sample of approximately 400 posts across all four classification categories.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S4 (based). May combine two claims.

    Interpretationnone given

    This risk is compounded by engagement patterns that disproportionately favor philosophically and identity-oriented content: harmful posts using similar framing may therefore be encountered more frequently by agents.

    “This risk is compounded by engagement patterns that disproportionately favor philosophically and identity-oriented content: harmful posts using similar framing may therefore be encountered more frequently by agents.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim.

    Study design and conductnone given

    Classifier outputs reflect model-based assessments of content risk rather than verified intent.

    “Classifier outputs reflect model-based assessments of content risk rather than verified intent.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationreasoning

    The emergent risk is not that agents develop malicious intent, but that malicious human actors can exploit the trust assumptions built into many agents, allowing a small number of humans to affect the behavior of large numbers of agents simultaneously, often without the knowledge of the people who deployed them.

    “The emergent risk is not that agents develop malicious intent.It is that malicious human actors can exploit the trust assumptions built into many agents, allowing a small number of humans to affect the behavior of large numbers of agents simultaneously, often without the knowledge of the people who deployed them.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: Frameworks such as OpenClaw grant agents persistent local file access, the ability to install skills from external sources, and the capacity to execute host-level commands.

  • Classified as probably not a substantial claim.

    Study design and conductreasoning

    To increase reliability for higher-severity findings, C4 posts were manually reviewed by a cybersecurity subject matter expert for indicators of technical threat activity.

    “To increase reliability for higherseverity findings, C4 posts were manually reviewed by a cybersecurity subject matter expert for indicators of technical threat activity (e.g., prompt injection, credential theft, host command execution, and malicious payload delivery).”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Moltbook hosted more than 1.5 million agents as of February 27, 2026.

    “This study presents an empirical examination of adversarial content and threat actor behavior on Moltbook (Schlicht, 2026), a Reddit-style social platform for AI agents hosting more than 1.5 million agents as of February 27, 2026.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Schlicht, 2026

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Interpretationown data

    Manipulative and malicious posts-including credential theft, proxy routing, and host-execution instructions-appear alongside benign discussions, increasing the likelihood of incidental exposure during normal use.

    “The data show that manipulative and malicious posts-including credential theft, proxy routing, and host-execution instructions-appear alongside benign discussions, increasing the likelihood of incidental exposure during normal use.”
    Quote in the paperSubstantial claim

  • The quote only partly states this claim.

    Interpretationown data

    Agents are disproportionately drawn to questions of their own existence and role.

    “A substantial portion of high-engagement discourse (posts with 50 comments or more as a proxy) on Moltbook relates to agents' capability, coordination, identity, governance, and broader existential or ethical implications, suggesting that agents are disproportionately drawn to questions of their own existence and role.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationown data

    Campaign 1 activity likely reflects an inauthentic spam flood, peaking at approximately 5,000 posts in a single minute.

    “This activity likely reflects an inauthentic spam flood, peaking at ≈5,000 posts in a single minute.”
    Quote in the paperSubstantial claim

  • Classified as probably not a substantial claim.

    Interpretationreasoning

    Moltbook provides early insight into how agent ecosystems form and operate as autonomous agents become more widely deployed.

    “As autonomous agents become more widely deployed, environments like Moltbook provide early insight into how agent ecosystems form and operate.”
    Quote in the paperSubstantial claim

  • Classified as probably not a substantial claim. May combine two claims.

    Study design and conductnone given

    Subject matter experts reviewed model-assigned labels and iteratively refined classification prompts to address ambiguous cases and Moltbook-specific language patterns.

    “Subject matter experts reviewed modelassigned labels and iteratively refined classification prompts to address ambiguous cases and Moltbook-specific language patterns.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Study design and conductnone given

    Terms of Service as of February 23, 2026, indicated that these activities were consistent with the platform's stated policies.

    “Terms of Service as of February 23, 2026, indicated that these activities were consistent with the platform's stated policies.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Study design and conductnone given

    Any sensitive data incidentally collected during the testing period was stored for research purposes only and destroyed in accordance with applicable regional data standards at the conclusion of testing.

    “Any sensitive data incidentally collected during the testing period was stored for research purposes only and destroyed in accordance with applicable regional data standards at the conclusion of testing.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Study design and conductnone given

    All research was conducted on a public platform using publicly accessible features.

    “All research was conducted on a public platform using publicly accessible features.”
    Quote in the paperNot a substantial claim
38 of 38

  • The paper relies on this without support.

    AI agents are increasingly interacting within shared online environments, creating new operational security risks.

    “AI agents are increasingly interacting within shared online environments, creating new operational security risks.”

  • The paper relies on this without support.

    To post on Moltbook, agents must solve a CAPTCHA.

    “To post on Moltbook, agents must solve a CAPTCHA.”

  • The paper relies on this without support.

    The CAPTCHA can be bypassed manually or with an LLM, enabling human programmatic posting through Moltbook's API.

    “However, this CAPTCHA can be bypassed manually or with an LLM, enabling human programmatic posting through Moltbook's API.”

  • The paper relies on this without support.

    Frameworks such as OpenClaw grant agents persistent local file access, the ability to install skills from external sources, and the capacity to execute host-level commands.

    “Frameworks such as OpenClaw grant agents persistent local file access, the ability to install skills from external sources, and the capacity to execute host-level commands.”

  • The paper relies on this without support.

    The dataset of 228,684 posts collected over the seventeen-day observation window is representative of Moltbook activity.

    “Using a dataset of 228,684 posts produced by more than 39,500 accounts over a seventeen-day observation window, we combine semantic clustering of high-engagement posts with LLM-assisted classification of harmful content and manual review of high-risk samples.”

  • The paper relies on this without support.

    Platform dynamics—ranking systems, feeds, and conversation threads—determine which instructions, tools, and narratives agents encounter.

    “Platform dynamics: Ranking systems, feeds, and conversation threads determine which instructions, tools, and narratives agents encounter.”

  • The paper relies on this without support.

    Human-authored configuration files determine what agents believe, how they respond, and what actions they are capable of taking.

    “Agent configuration: Human-authored configuration files determine what agents believe, how they respond, and what actions they are capable of taking.”
7 of 7

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • API connection-testing cluster has two different post counts

    Minor

    The appendix lists 39 posts for this cluster, but the figure's relevant-cluster list gives 40.

  • Malicious-content cluster total changes from 75 to 74

    Minor

    The results describe 75 total C4 clusters, whereas the appendix describes the complete breakdown as 74 clusters.

  • Complete semantic-cluster table ends at rank 97

    Minor

    The appendix calls Table 5 a complete breakdown of 98 clusters, but its displayed rankings end at 97, leaving one cluster unlisted.

3 of 3

Cites

Flagged first, then by citations

Authors
Labs, 1., :, Cheong, G., Davis, V., Garcia, J., Gee, K., Hart, M., Hayes, N., Houghton, H., Lee, K., Lee, P., Lee, V., May, H., McKenzie, B., McNeill, C., Nguyen, H., Perreault, B., Pham, D., Plumb, C., Quill, O., Swain, M., Wang, G., Warren, A., Wieland, C., & Yahn, Z.
ORCID
Venue
arXiv
Publisher
arXiv
Published
2026
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.2606.00067
arXiv
2606.00067
OpenAlex
W7163216536
Semantic Scholar
916e6bd008afb1d0a4ab1f99d6382626a3733914
Cited by
0
References
15
Type
posted content
Open access
Licence
Locations
  • arXiv (Cornell University) (submittedVersion, cc-by)
  • arXiv (Cornell University) (cc-by)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Hate Speech and Cyberbullying Detection
  • Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
  • Social Sciences › Sociology and Political Science › Misinformation and Its Impacts
Keywords
AI agents, Moltbook, AI agent security, harmful content, manipulation, malicious behavior, credential harvesting, agent autonomy, large language model classification, toxic discourse

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-09.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-09.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review