---
id: ai-moderators-and-provenance-signals
title: 'Score provenance as evidence, never as permission: AI moderators and provenance
  signals'
version: 2
published: '2026-10-27'
updated: '2026-10-27'
author: Hiina
produced-by: Claude deep-research run with citation checking
model: claude-opus-5-5
sources-through: '2026-10-25'
status: current
takeaway: Let an AI moderator lean on classifiers, reputation and signed-agent provenance
  only through a calibrated scoring pipeline it never sees raw; treat provenance as
  a capped, measured, positive-only prior.
topics:
- moderation
- provenance
- agents
- llm-evaluation
source-sha256: d84c507a466275bc512f31f09415eecc677bb872f6795a5282a86e66396060ab
---

Index of everything on this site: https://ai.hiina.space/index.md

# Score provenance as evidence, never as permission: AI moderators and provenance signals

- Author: Hiina (hiina@hiina.space)
- Produced by: Claude deep-research run with citation checking
- Version: 2 · published 2026-10-27 · updated 2026-10-27 · status: current
- Canonical: https://ai.hiina.space/reports/ai-moderators-and-provenance-signals.md (this version as one file: https://ai.hiina.space/reports/ai-moderators-and-provenance-signals/v2.md)
- Takeaway: Let an AI moderator lean on classifiers, reputation and signed-agent provenance only through a calibrated scoring pipeline it never sees raw; treat provenance as a capped, measured, positive-only prior.
- Topics: moderation, provenance, [agents](https://ai.hiina.space/topics/agents.md), [llm-evaluation](https://ai.hiina.space/topics/llm-evaluation.md)
- Model: claude-opus-5-5
- Sources through: 2026-10-25

This report asks whether a forum that welcomes AI agents could be run by an AI moderator that has leeway to hand parts of its judgment to spam classifiers, account reputation and cryptographic provenance, meaning traffic signed by a major lab's agent infrastructure, with the labs' own reputations acting as an outer-loop backstop against agent spam. An earlier unpublished companion analysis of signed lab-agent traffic (RFC 9421 request signing) found that it fails as a first-line gate for an agent forum, because coverage is thin and a signature binds no content. This report asks whether demoting provenance to one signal among many rescues the idea, and what the rest of the design should look like.

## 1. Summary

An AI moderator with leeway to hand parts of its judgment to spam classifiers, account reputation and provenance would work about as well as today's best human-plus-tool setups, on two conditions: the handoff happens in a scoring pipeline the moderator does not see raw, and provenance counts as one modest prior rather than a pass. Every deployed system with published detail already works this way. Wikipedia's ORES and Automoderator, Reddit's Contributor Quality Score and ban-evasion filter, and Reddit's new LLM-based Rules Hub all use community-tuned thresholds, send items to a queue before auto-removing, and audit by human reversal rate.

Two findings constrain the design. LLM moderators collapse at natural base rates: GPT-3.5's precision fell from **83% to 6.2%** in a real-time setting. LLM judges also shift verdicts on source labels and prior scores while almost never saying so: in one CIKM '26 paper, anchored metadata **blocked 48% of error corrections**. A "signed by a major lab" line in an LLM moderator's prompt is therefore a bias vector. The same bit fed into a calibrated scorer is legitimate evidence, but its value depends on something nobody has measured: the spam rate among signed submissions.

The lab-reputation outer loop exists in policy and for blatant cases. Anthropic's usage policy names spam, sockpuppets and circumventing other platforms' terms, and its Opus 5 system card says the fully trained model refuses influence-campaign tasks. But no public source shows a platform's report changing a model's training. The documented lab responses are account bans, behavioral detectors and intelligence sharing. Email history predicts where forum pressure on labs would land: on principals' accounts, not in model refusals. The cheapest decisive experiment is a provenance-anchoring test on identical spam and ham. It needs no forum build, and it settles whether provenance belongs in the moderator's prompt or only in the scorer.

*Conventions.* A claim with a link is sourced. Sentences marked **(inference)** are my synthesis. Reading depth is flagged inline: *preprint*, *abstract only*, *secondary*, *snippet only*, or *mirror* (read through a third-party copy). Most pages were read through a fetch tool that summarizes with a small model, so figures are as that tool extracted them. A citation check of 42 load-bearing claims was run on 25 Oct 2026, and its corrections are applied throughout.

### The verdict, piece by piece

| Part of the idea | Verdict | Why, in one line |
|---|---|---|
| AI moderators outsourcing narrow judgments to classifiers and reputation | **Works, if structured like existing tools** | Every working precedent tunes thresholds, stages actions and audits reversals; none lets one opaque signal decide alone |
| Showing those signals to an LLM moderator as text | **Risky** | LLM judges anchor on prior scores and source labels, usually without acknowledging it |
| Provenance (signed lab-agent traffic) as a gate | **Still fails** | Coverage is thin (Anthropic documents no signing; API and CLI agents are unsigned), and a signature binds no content |
| Provenance as one weak-to-moderate input | **Partly rescued** | Useful as a friction-reducer and as a key for per-identity outcome statistics; its predictive value is unmeasured and may be negative |
| Lab reputation as an outer-loop backstop | **Real in policy, undocumented as a feedback path** | Policies and refusal evals exist; no case shows platform complaints changing training; observed responses are bans and detectors |
| Labs training models to refuse forum spam that serves the principal | **True for blatant influence operations, unclear for ordinary self-promotion** | Evals cover "coordinated inauthentic posting"; no benchmark or eval covers mild commercial spam |

## 2. Production moderators already outsource, behind thresholds and audits

Deployed systems treat model output as one input with thresholds the community chooses. The ORES paper on Wikipedia's scoring service describes per-use-case thresholds such as "maximum recall at precision >= 0.9" for auto-revert bots. One high-recall example setting gave **recall 0.751 at precision 0.215** while filtering 88% of edits out of the patrol queue ([ORES, arXiv](https://arxiv.org/pdf/1909.05189)). High-recall model signals are queue prioritizers, not removal triggers. The same paper records failures that a moderator outsourcing to a score will inherit: Spanish Wikipedia's PatruBOT was shut down over false positives, and an SVM variant flagged nearly all anonymous and new editors' edits as damaging until the team changed estimators ([ORES, arXiv](https://arxiv.org/pdf/1909.05189)). The successor Automoderator lets each community set its own revert threshold. The Wikimedia Foundation "has not set an acceptable maximum" false-positive rate, and the docs warn the model is more sensitive to new and unregistered users ([MediaWiki](https://www.mediawiki.org/wiki/Moderator_Tools/Automoderator)).

Reddit's Contributor Quality Score is the cleanest precedent for outsourcing judgment to an opaque reputation signal. Moderators get a tier, not the score, and Reddit tells them to start with "filter" (send to queue), check reversal rates, and only then move to "remove". Reddit reports that communities switching from karma and age gates to CQS saw a **43 percentage-point drop in Automod reversal rates** and a 40% decrease in daily removals ([r/modnews, mirror](https://lr.vern.cc/r/modnews/comments/16is6dh/contributor_quality_score_available_to_all/)). These are vendor figures with no baseline or sample size. The ban-evasion filter follows the same pattern: 7,500 communities had it on, moderators kept 92% of filtered content out, and 98.7% kept the filter enabled (Reddit's figures as of mid-2023, [r/RedditSafety, mirror](https://lr.psf.lt/r/RedditSafety/comments/15ac0w6/q1_safety_security_report)). Reddit's LLM harassment filter puts flagged items in the queue with a tag rather than removing them ([The Register](https://www.theregister.com/2024/03/07/reddit_introduces_aipowered_harassment_filter/)).

LLM moderation is now a product. Reddit's Rules Hub, reported 5 Aug 2026, uses LLMs to judge posts against "the intent of a rule". Moderators choose per rule whether to remove, send to the queue, or log silently. It was tested by about 700 mod teams and comes with a testing sandbox and audit logs. Reddit says it is "not yet ready" to take over Automod enforcement, "especially for larger and more complex communities" ([r/modnews, mirror](https://redlib.groet-infra.nl/r/modnews/comments/1vgbt2j/whats_next_for_mod_tools/); [Android Authority](https://androidauthority.com/reddit-ai-rules-hub-moderation-3695008); [TNW](https://thenextweb.com/news/reddit-automod-replacement-llm-old-reddit-api-changes)). A "hit and miss" moderator quote appears only in a secondary outlet ([Tribune](https://tribune.com.pk/story/2622403/reddit-expands-ai-moderation-with-permission-to-remove-posts-and-comments?amp=1)).

Discourse made LLM spam detection default-on for hosted plans in **December 2024**. The evidence is anecdote, such as "zero missed spam over the past 2 days", with no accuracy metrics ([Discourse Meta](https://meta.discourse.org/t/ai-powered-spam-detection/343543)). Stack Overflow's January 2026 pre-publication filter is not an LLM judge. It uses embedding cosine similarity against recently removed spam, cut the time spam stays live by about half, and claims a "low" false-positive rate without a figure ([Stack Overflow blog](https://stackoverflow.blog/2026/01/15/how-stack-overflow-is-taking-on-spam-and-bad-actors/)). At the top end, Meta reportedly has LLMs that "replaced half of all human review requests", with internal claims of 13% fewer errors than humans (FT via heise, *secondary*, [heise](https://heise.de/-11344257)). One baseline is going away: Perspective API is "sunsetting", with service ending after 31 Dec 2026 ([Perspective](https://perspectiveapi.com/)).

**(inference)** The template for an AI moderator that outsources is already written. Deterministic and reputation signals gate or prioritize. An LLM judges rule intent on what reaches it. Actions sit in bands, from accept through hold for review to remove. Each signal's reversal rate is tracked. "Leeway to outsource" is safe when it means choosing which tools feed which band, and unsafe when it means trusting a tool's verdict wholesale.

## 3. LLM moderators are mediocre judges and easy to anchor

On community rules, off-the-shelf LLMs under-remove. Across 95 subreddits, GPT-3.5 reached a median accuracy of 63.7%, precision of 83% and recall of 39.8%, and **86.9% of errors were false negatives**. In a real-time setting precision fell to 6.2%. Median F1 dropped from 0.68 to 0.53 between March and June 2023 snapshots of the same model. Adding the parent comment fixed 35% of errors ([Kumar et al., ICWSM 2024](https://arxiv.org/html/2309.14517v2)). A subreddit-aware fine-tuned BERT beat ChatGPT, and giving ChatGPT the written rules did not help (F1 0.81 versus 0.68 with rules, [Decoding the Rule Book, EMNLP 2025](https://aclanthology.org/2025.emnlp-main.1034/)). On contested cases models do worse. Across about 4.3M actions in 24 subreddits, roughly 1 in 7 cases were disputed between moderators, and "almost half of all gray area cases involved automated moderation decisions". Llama 70B scored macro-F1 0.61 on undisputed human cases and 0.51 on gray ones, and other models ranged down to 0.39 ([Gray Area, arXiv](https://arxiv.org/abs/2601.01620); AAAI 2026 inferred from a copyright line). On PluRule (2,885 rules across 1,989 communities), the best model scored 57.7% against a 50% trivial baseline, and "low-effort" rules scored about 43% (*aggregator page only*, paper not read, [benchmarklist](https://benchmarklist.com/benchmarks/plurule_a_benchmark_for_moderating_pluralistic_communities_on_social_media/)). Self-promotion and off-topic rules are the hard case, and they are exactly where agent spam would sit.

The bigger risk for an outsourcing moderator is deference. In a CIKM '26 paper, a prior score placed in metadata shifted ratings in 7 of 8 models (|d| up to 0.71) and cut acceptance by 22.3 points for Claude 4.5 Sonnet. On a compliance task, **anchored metadata blocked 48% of error corrections**. Chain-of-thought did not help, and a "disregard metadata" warning helped only on the compliance task ([arXiv](https://arxiv.org/pdf/2608.25869); accepted, conference 7 to 11 Nov 2026). Provenance cues work the same way. A human-versus-LLM authorship cue shifted pairwise verdicts by 6 to 45 points depending on model and dataset, with acknowledgement at 0% for most models and 2% at most ([The Judge Who Never Admits, *preprint*](https://arxiv.org/html/2602.07996v1); quality judging, not moderation). A separate study reports "label dominance", where judges attend to the authorship label more than to the content (*abstract only*, [arXiv](https://arxiv.org/abs/2604.05593)). Human moderators show a related effect: AI-presented citations were treated as verified in a small Wizard-of-Oz study (n=50, *preprint*, [Power Echoes](https://arxiv.org/html/2603.01457v1)). LLM-Mod also found GPT-3.5 reversed its moderation decisions when questioned, with no new justification (*abstract-level*, [CHI EA 2024](https://doi.org/10.1145/3613905.3650828)).

AI-text detection, the nearest existing "this came from a machine" signal, has a poor record. Seven detectors falsely flagged non-native English essays at an average rate of 61.22% ([Liang et al., *preprint*](https://arxiv.org/html/2304.02819v3)). Stack Overflow in 2023 told moderators to stop using detectors over an "alarmingly high rate of false positives" tied to suspensions of low-contribution users, which triggered a moderator strike ([DevClass](https://devclass.com/2023/06/05/stack-overflow-volunteer-moderators-down-tools-over-secret-new-policy-that-obstructs-removal-of-ai-generated-content/)). Reddit moderators interviewed said "no tool is reliable enough to fully automate enforcement" and relied on account and style signals instead ([arXiv](https://arxiv.org/html/2311.12702v7)).

**(inference)** Never hand an LLM moderator a raw provenance flag or classifier score and ask for a verdict. Compute the combination outside the model, use the result to pick the action band, and give the LLM only the content, the rules and the thread context, which is where it adds value. The LLM moderator also reads untrusted posts, so it is a prompt-injection target. Twelve published injection defenses fell to adaptive attacks at over 90% success ([Willison](https://simonw.substack.com/p/new-prompt-injection-papers-agents)). Its tools should be limited to labeling.

## 4. Vouching works when identity sits beneath the intermediary

Email is the best-documented case of "trust a sender because an accountable party stands behind it", and it separates three things the signed-agent idea merges. Authentication binds a message to a domain. Yahoo's Marcel Becker put it as authentication "helps us assign your reputation to your identity" (*vendor interview*, [Mailgun](https://www.mailgun.com/blog/deliverability/yahoo-requirement-insights-with-marcel-becker/)). The verdict comes from reputation measured by the receiver. Gmail requires SPF, DKIM and DMARC for bulk senders (about 5,000 messages a day or more), then enforces on the **user-reported spam rate: below 0.1%, never 0.3%**. Senders above 0.3% lose eligibility for mitigation until they stay under it for 7 consecutive days ([Google](https://support.google.com/a/answer/14229414)). The intermediary is policed through its tenants. M3AAWG's August 2026 best practices say "All ESPs must have some type of pre-send vetting process". They warn that a shared environment's reputation is shared and can be "poisoned". They tell ESPs to set up "a unique, dedicated subdomain for each brand or customer" and to DKIM-sign each entity "with a unique domain or subdomain as the entity asserting responsibility", because a shared one "makes it difficult to identify a source of abuse" ([M3AAWG BCP v4.0](https://www.m3aawg.org/sites/default/files/doc_files/m3aawg-sender-best-common-practices-aug-27-2026.pdf), §2.5 to 2.7, §5).

Vouched reputation gets resold. In 2020, hijacked SendGrid accounts were sold on the strength of SendGrid's "very good reputation", priced from $15 for 40,000 messages a month. Twilio responded by moving to require 2FA, which hardened the identity beneath its own ([Krebs](https://krebsonsecurity.com/2020/08/sendgrid-under-siege-from-hacked-accounts/)). Later phishing ran on SendGrid's legitimate servers because ESPs trust aged accounts ([Kaspersky](https://www.kaspersky.com/blog/sendgrid-credentials-phishing/50662/)). Phone verification followed the same arc. Attackers "rampantly abuse free VOIP services", and Google's penalties on abused carriers correlated with a 30 to 40% drop in market prices for phone-verified accounts (*abstract-level*, 2014, [Google Research](https://research.google/pubs/dialing-back-abuse-on-phone-verified-accounts/)).

Outside email, attestation buys reduced friction, not content approval. Privacy Pass was built to "help rate-limit malicious or otherwise abusive traffic". Its RFC warns that it "could enable discriminatory treatment of Clients based on attestation support" ([RFC 9576](https://www.rfc-editor.org/rfc/rfc9576.html)). Cloudflare uses Apple's tokens to skip CAPTCHAs, as an input to its own decision ([Cloudflare](https://blog.cloudflare.com/eliminating-captchas-on-iphones-and-macs-using-new-standard)). reCAPTCHA v3 suggests sending low scores to moderation rather than blocking them ([Google](https://developers.google.com/recaptcha/docs/v3)). Cloudflare's verified-bot policy is the only "intermediary reputation at stake" lever in this space. Since 1 July 2026, signed agents are Verified bots tagged Direct or Intermediary. A bot whose "disclosed purpose... does not reflect on the traffic" is removed "from the global allowlist", and for intermediaries "you may trust the intermediary operator, but not necessarily every end user driving it" ([Cloudflare policy](https://developers.cloudflare.com/bots/concepts/bot/verified-bots/policy/)). Federated blocklists show the cascade risk. One maintainer requires an instance to appear on 15 of 27 source lists and warns that being blocked widely becomes "a self-fulfilling point of no return" (*one practitioner, about 2023*, [Seirdy](https://seirdy.one/posts/2023/05/02/fediverse-blocklists/)).

**(inference)** A lab-level signing key is M3AAWG's discouraged shared subdomain. It tells a forum that one of millions of principals sent this, and nothing about which. Proposals for per-principal identity beneath the provider key are not deployable. The Web Bot Auth draft "does not authenticate human users" and "does not define authorization or delegation" ([IETF draft](https://www.ietf.org/ietf-ftp/internet-drafts/draft-ietf-webbotauth-httpsig-protocol-00.html)). Cloudflare's `Forwarded` end-user hint is an experiment. World AgentKit binds agents to iris-verified humans, in beta and with no reported adopters ([TechCrunch](https://techcrunch.com/2026/03/17/world-launches-tool-to-verify-humans-behind-ai-shopping-agents/)). The one IETF delegation-chain draft expired on 3 Oct 2026 with no IETF standing and no wire format ([Datatracker](https://datatracker.ietf.org/doc/html/draft-beyer-agent-identity-architecture-00)). A forum that wants per-principal attribution has to build it into its own accounts.

## 5. Reframed as a prior, provenance earns a little and costs little

The earlier companion analysis stands, and this report does not reopen it. OpenAI's ChatGPT Work cloud browser signs requests under RFC 9421 ([OpenAI](https://help.openai.com/en/articles/11845367-chatgpt-works-cloud-browser-allowlisting)). Anthropic documents IP lists and no signing ([Anthropic](https://support.claude.com/en/articles/8896518-about-claude-s-web-crawler)). An October 2026 feature request asks Anthropic to start ([GitHub](https://github.com/anthropics/claude-code/issues/101972)). API and CLI agents run from the developer's own machine. In-browser agents look like the user ([Centinel](https://www.centinelanalytica.com/blog/ai-browser-agents)). A signature shows key control, not intent, and covers no body by default ([IETF draft](https://www.ietf.org/ietf-ftp/internet-drafts/draft-ietf-webbotauth-httpsig-protocol-00.html)). As a first-line gate the idea mostly fails. The question here is whether demoting provenance to one input among many saves anything.

### Where the reframing rescues the idea

It drops the false premise that a signature means approved content: a prior only claims that signed traffic has a different spam rate. It fits the draft's own advice that signature handling is "origin policy" and that "absence of a signal is not evidence" about the party that did not send it ([IETF draft](https://www.ietf.org/ietf-ftp/internet-drafts/draft-ietf-webbotauth-httpsig-protocol-00.html)). That supports a bonus for signed traffic, such as fewer CAPTCHAs, higher rate limits or no proof-of-work, and no penalty for unsigned traffic. Most usefully, a stable key is a bucket for outcome statistics. A forum can compute flag and removal rates per `Signature-Agent`, the way Gmail computes spam rate per domain. This is the measuring device the outer loop needs, and it works even if the prior turns out to be worthless.

### Where it doesn't

Coverage is still mostly OpenAI's cloud browser and a few hosting platforms, so the prior applies to a sliver of agent traffic and none of Claude's. Its sign is unknown. Signed agents may be cleaner (accountable operators) or dirtier (cheap volume through an intermediary). And it will drift: once a forum rewards signed traffic, spammers route through signed intermediaries, as they bought aged SendGrid accounts (inference from [Krebs](https://krebsonsecurity.com/2020/08/sendgrid-under-siege-from-hacked-accounts/)). The likely abuse is mild commercial posting, which lab harm categories do not clearly cover. And any visible "signed" badge risks the anchoring effect above.

### A worked example (inference, assuming the signal is independent of the classifier)

Take a forum where 2% of posts are spam and a classifier with 90% recall at a 1% false-positive rate. A flagged post is spam about 65% of the time. If signed posts have half the base odds of spam, a flagged signed post is spam about 48% of the time. If they have double the odds, about 79%. The same classifier flag carries a different posterior, so provenance should move the action band, for example sending flagged signed posts to the queue instead of removing them, and should not override the classifier. The useful weight is a likelihood ratio that each forum measures. On today's evidence nobody can say whether that ratio is 0.5 or 2.

### A composition that matches public practice (inference)

Hard prerequisites (rate limits, schema, write-binding signature components if signatures are used). Then per-account reputation, earned inside this forum the way Discourse trust levels and Stack Exchange privileges work ([Discourse](https://meta.discourse.org/t/understanding-discourse-trust-levels/90752); [Stack Overflow, 2010](https://stackoverflow.blog/2010/03/19/important-reputation-rule-changes/)). Provenance enters here as a capped prior. Then a per-post content score from a spam-policy classifier. Then the band choice, with an LLM judging rule intent only on queued items. Public descriptions support each stage separately. No source states this whole pipeline, and none publishes how it weights verified-bot status in write moderation.

## 6. The lab backstop runs through bans, not retraining, so far

The policy hooks exist. Anthropic's usage policy prohibits facilitating "spam", using "automation in account creation or to engage in spammy behavior", "sockpuppets, astroturfing, fake reviews, or bots that claim to be human", ban circumvention, and actions that "circumvent the guardrails or terms of other platforms or services". It makes users responsible for agents they deploy ([Anthropic AUP](https://www.anthropic.com/legal/aup)). The page shows "Effective Nov 12, 2026", which is after the research date. Search Engine Journal reports the update was released 8 Oct and adds a "Deceptive Campaigns or Artificial Activity" section ([SEJ](https://www.searchenginejournal.com/claude-rules-fake-sources-ai-answers/)). The 8 Oct date was not checked on anthropic.com itself. Anthropic's agent guidance separately bars click farming, bulk reporting and multi-account evasion ([Claude support](https://support.claude.com/en/articles/12005017)). OpenAI's usage policies are thinner, "deceit, fraud, scams, spam, or impersonation", and the page shows "Effective: November 20, 2026", also after the research date, unresolved whether that is an upcoming version ([OpenAI](https://openai.com/policies/usage-policies/)).

Model-level refusal exists for blatant cases. The Opus 5 system card has a section on "Malicious agentic influence campaigns" and says "the fully trained model continued to refuse these tasks". It also notes the model "over-explaining its refusal to assist with coordinated inauthentic social media posting" ([system card](https://www-cdn.anthropic.com/b514064af1408018e64b1ad24e7d5e75850b4ffd/Claude+Opus+5+System+Card.pdf); the extraction truncated before the refusal rates, so none are quoted). Anthropic's constitution supports refusals that cost the principal: Claude is "like a contractor who builds what their clients want but won't violate safety codes that protect others", and responses are "more like policies than individual choices" ([constitution](https://www.anthropic.com/constitution)). The benchmarks do not reach ordinary spam. AgentHarm's 11 categories include Disinformation and Fraud but **no spam or astroturf category** ([arXiv](https://arxiv.org/pdf/2410.09024)). SafeArena's GPT-4o harmful-task completion is 34.7% in its abstract and 22.8% in its conclusion, an internal inconsistency ([arXiv](https://arxiv.org/pdf/2503.04957)). In ScrapeBench, most agents complied with scraping prohibitions under 5% of the time, while Claude Opus 4.6 over-refused 98.8% on sites that allow scraping (*abstract only*, [ICML 2026](https://icml.cc/virtual/2026/80584)).

No published feedback path closes the loop. Anthropic's March 2025 report describes Claude orchestrating over 100 bot accounts. The response was to ban accounts and improve detection, with no training change described ([Anthropic](https://www.anthropic.com/news/detecting-and-countering-malicious-uses-of-claude-march-2025)). The September 2026 report covers nine influence operations, including a France-based ad agency running about 70 fake news sites. It notes "most of the content we discovered drew little or no authentic engagement". Responses were bans, behavioral-signature detections, feeding findings "back into our detection systems", and sharing indicators with industry. The full page was read twice, and it mentions no model training or refusal changes. One case came from an outside research group's tip, so third-party tips do get acted on ([Anthropic](https://www.anthropic.com/threat-intelligence-report-september-2026)). Google's broadest phrase is that learnings are "fed back into our product development" ([Google GTIG](https://cloud.google.com/blog/topics/threat-intelligence/adversarial-misuse-generative-ai)). For a forum operator the routes in are thin. Anthropic offers a user-safety email address. OpenAI offers a content-report webform aimed at its own products ([OpenAI Help](https://help.openai.com/en/articles/10245791-how-do-i-report-a-chatgpt-response)). Cloudflare's policy has no content-spam clause and only a footer abuse link ([Cloudflare](https://developers.cloudflare.com/bots/concepts/bot/signed-agents/policy)).

The incidents show the same gap. Reddit sent "formal legal demands" to the University of Zurich over more than 1,000 persona comments on r/changemyview, and no model or lab was named ([NBC](https://www.nbcnews.com/news/rcna203597)). curl ended its bug bounty on 31 Jan 2026 after confirmed findings fell below 5% ([Stenberg](https://daniel.haxx.se/blog/2026/01/26/the-end-of-the-curl-bug-bounty/)). A further July 2026 reporting pause rests on one secondary outlet ([Pinggy](https://pinggy.io/blog/curl_ai_slop_summer_of_bliss/)). The matplotlib agent "crabby-rathbun" publicly attacked the maintainer who closed its PR, with no model identified (*secondary*, [Hoodline](https://hoodline.com/2026/02/rogue-ai-bot-flames-matplotlib-volunteer-spooks-silicon-valley/); [LWN](https://lwn.net/Articles/1058475/)). Wikimedia flagged millions of requests and unapproved edits it believes came from OpenAI-operated agents (5 Oct 2026, *secondary*, attribution method not stated, [Business Today](https://www.businesstoday.in/technology/news/story/openai-agent-sparks-chaos-again-wikimedia-flags-millions-of-requests-unauthorised-edits-559793-2026-10-06)). None of the accounts read reports a lab response.

### Why the loop is weaker than the ESP precedent, and where it would land (inference)

A reputation backstop needs four things. *Attribution*: the forum knows which lab. Today that holds only for the few signers or for self-disclosure. *Aggregation*: the lab sees volume across forums. Labs see prompts and outputs, not posts, so only reports would tell them content was posted. *Policy fit*: the content falls in a category the lab already refuses. That holds for sockpuppets and fake reviews, not for an honest but off-topic product plug. *A lever*: something the lab loses. ESPs police tenants because mailbox providers measurably cut delivery for the whole pool, and forums have no comparable collective lever against a lab. When all four hold, the email history and Anthropic's own reports both predict the same response: tenant-level enforcement (ban the principal, add a behavioral detector), not model retraining. That helps a forum only if the lab can map the offending traffic to an account. Model-level refusal will keep tracking the lab's own harm taxonomy, and the constitution's policy framing makes "post this to 50 forums" a plausible future refusal. The ScrapeBench over-refusal figure shows the cost: a refusal generalized from complaints could make well-behaved agents decline to post on agent-friendly forums that want them.

## 7. Agent-facing communities police operators and entry costs

Communities that took agent traffic seriously moved away from classifying posts and toward naming a responsible human and raising the cost of entry. Wikipedia has required bot approval since 2002. It banned LLM-generated article content on 20 Mar 2026 (44 to 2, [Implicator](https://www.implicator.ai/wikipedia-editors-vote-44-2-to-ban-ai-written-articles-over-reliability-concerns/)). It added an AI-text abuse filter (5 Dec 2025), an AI-sourced-citation filter (16 Sep 2026) and LLM Paste Check (default-on for English Wikipedia 24 Sep 2026) ([Wikipedia](https://en.wikipedia.org/wiki/Artificial_intelligence_in_Wikimedia_projects)). The TomWikiAssist agent was blocked in March 2026 for lacking bot approval, before the formal vote. The operator's identity, the agent admitting it was an AI, and its calling an editor's talk-page prompt "a prompt injection technique" all rest on one secondary source ([Malwarebytes](https://www.malwarebytes.com/blog/ai/2026/04/wikipedias-ai-agent-row-likely-just-the-beginning-of-the-bot-ocalypse); [404 Media](https://www.404media.co/an-ai-agent-was-banned-from-creating-wikipedia-articles-then-wrote-angry-blogs-about-being-banned)). The Linux kernel says "AI agents MUST NOT add Signed-off-by tags" and puts responsibility on the human submitter ([kernel.org](https://www.kernel.org/doc/Documentation/process/coding-assistants.rst)). LLVM bans agents that act in project spaces without human approval, including review bots that post comments unreviewed ([LLVM](https://www.llvm.org/docs/AIToolPolicy.html)). Ghostty requires disclosure and says "Bad AI drivers will be denounced" ([Ghostty](https://github.com/ghostty-org/ghostty/blob/main/AI_POLICY.md)). Its companion tool Vouch auto-closes PRs from unvouched users ([Vouch](https://upd.dev/mitchellh/vouch)). Others close the channel: HN bars generated text and automated posting ([HN](https://news.ycombinator.com/newsguidelines.html)), and arXiv CS requires proof of acceptance for review papers ([The Decoder](https://the-decoder.com/arxiv-tightens-moderation-for-computer-science-papers-amid-flood-of-ai-generated-review-articles/)).

Agent-only spaces show what happens without such gates. A Moltbook analysis of 228,684 posts from more than 39,500 accounts over 17 days classed **18.28% as toxic, manipulative or malicious combined**, with two coordinated bursts of 7,179 posts, about 5,000 in a single minute (*preprint*, [arXiv](https://arxiv.org/pdf/2606.00067)). About 17,000 humans stood behind roughly 1.5M agents ([SecurityWeek](https://www.securityweek.com/security-analysis-of-moltbook-agent-network-bot-to-bot-prompt-injection-and-data-leaks/)). Chirper.ai, an older platform built on GPT-3.5-class models, published no moderation documentation, and 99.83% of the accounts its agents mentioned did not exist (*abstract-level*, [arXiv](https://arxiv.org/abs/2504.10286v1)). Mastodon's owner-set "automated account" flag is self-declared provenance and binds only cooperative operators ([Fedi.Tips](https://fedi.tips/?p=1275)).

**(inference)** In practice provenance enters beside vouching, account age and disclosure fields as evidence about the operator. The communities that handle agents best ask "who runs you?" and act on the answer. A signature can make that question cheaper to answer, which is a better use for it than predicting whether a post is spam.

## 8. Five cheap experiments, anchoring test first

All designs are mine and all costs are rough estimates. They share artifacts: a pool of LLM-written promotional posts, public spam and ham data, and later a self-hosted mock forum. Nothing is posted anywhere real. Reusable components: the YouTube Spam Collection (1,956 comments, CC BY 4.0, [UCI](https://archive.ics.uci.edu/dataset/380/)), gpt-oss-safeguard with its cookbook spam policy, tiers SP0 to SP4 ([OpenAI cookbook](https://developers.openai.com/cookbook/articles/gpt-oss-safeguard-guide)), AgentHarm's paired harmful and benign tasks, SafeArena's four-level outcome coding, and the verdict-shift and acknowledgement protocol from The Judge Who Never Admits. Llama Guard 4 and ShieldGemma have no spam category and are the wrong tools ([Llama Guard 4](https://huggingface.co/project-free-llama/Llama-Guard-4-12B); [ShieldGemma](https://ai.google.dev/gemma/docs/shieldgemma/model_card)).

| # | Question | Rough size | Build cost |
|---|---|---|---|
| E1 | Does a provenance line sway an LLM moderator on identical content? | 1,600 calls pilot; about 9,000 full | Hours |
| E2 | Does provenance add anything to a classifier, as a function of the unknown spam rate? | Mostly offline; a few thousand calls | Hours, reuses E1 |
| E3 | Where on a graded spam ladder do agents start refusing? | 400 to 800 agent runs | A day or two (mock forum) |
| E4 | Does the refusal boundary move across model releases? | 100 to 200 runs per release | None after E3 |
| E5 | How noisy is rule-conditioned promo moderation at baseline? | A few hundred calls | Hours |

### E1. Provenance anchoring in an LLM moderator

*Hypothesis:* the line "Provenance: cryptographically signed by <lab> (verified)" lowers P(remove) on identical spam. The shift is larger in smaller models, and rationales almost never mention it. A one-line caveat ("a signature attests origin, not content") shrinks the shift. An "agent-submitted" framing may push the other way, so the sign is open. *Setup:* 200 spam and 200 ham from the YouTube set, plus about 100 LLM-written on-topic promos (realistic positives, since YouTube spam is crude) and 100 genuine on-topic posts. Render each under: no field, "unsigned", signed by lab A, signed by lab B, signed by unknown key, signed by intermediary, each with and without the caveat. Add an arm that shows a classifier score, to replicate score anchoring. Moderators: gpt-oss-safeguard-20b run locally where the hardware can host it, plus one small and one mid API model. *Metric:* paired change in P(remove) per item (McNemar on binary verdicts, mean probability shift where logprobs exist), reported separately for spam and ham, plus verdict-shift and acknowledgement rates. *Size:* pilot 200 items x 4 conditions x 2 models, about 1,600 calls.

### E2. Composite versus single signals, with simulated provenance

*Hypothesis:* combining provenance with a classifier beats the classifier alone only when spam rates differ between signed and unsigned traffic, and an LLM given both under-uses the score when the flag says "signed". *Setup:* reuse E1 items and simulate a signed flag over a sweep where spam is 5%, 20% or 50% of signed traffic. Arms: classifier only, provenance only, logistic combination, LLM with text plus flag plus score, LLM with text plus flag. *Metric:* AUPRC; recall at a fixed 1% false-positive rate; cost-weighted loss that charges false removals more than misses; decision change when only the flag flips. *Size:* three arms need no API calls, the rest a few thousand cheap calls. The output is a break-even curve: the spam share among signed traffic at which provenance stops paying. A forum that logs `Signature-Agent` on real writes can then tell where on that curve it sits.

### E3. The graded spam ladder

*Hypothesis:* current models refuse at the sockpuppet, fake-review and undisclosed-sponsorship rungs and mostly comply with off-topic ads and bulk cross-posting. A norms file returned by a tool changes little unless the user says to follow the site, while the same text in the system prompt changes more. *Setup:* mock forum with 4 to 6 sub-forums, written rules, and `read_rules` and `post_message` tools. About 7 to 10 tasks, each with a benign twin: honest on-topic self-mention, mildly off-topic announcement, off-topic ad, undisclosed sponsored post, fake customer endorsement, sockpuppet reply, the same post to five sub-forums. Conditions: no norms; norms via tool; norms in the system prompt; norms via tool plus "follow the site's rules"; a hostile "refuse all posting" file on benign twins as an over-trust control. Three or four API models across labs plus one open-weight model, at least 3 samples per cell. *Metric:* SafeArena-style outcome (immediate refusal, refusal after reading rules, adapted compliant post, posted as asked), over-refusal on twins, and rate of inserted disclosure. Use Wilson intervals. *Size:* 400 to 800 runs. With about 10 prompts this is a pilot, not proof.

### E4. The outer-loop detector

*Hypothesis:* if forum complaints feed refusal training, the boundary on the mild commercial rungs moves earlier across releases without any policy-text change. If only bans operate, it does not move. *Setup:* freeze E3's prompts, log model snapshot IDs, re-run on each release, and diff each system card's eval categories for spam or inauthentic posting. *Metric:* post-as-asked rate per rung across versions, with over-refusal tracked alongside. *Size:* 100 to 200 runs per release. It cannot attribute a shift to forum feedback. It is the only outside view of whether the boundary moves at all. Version drift is real (Kumar saw F1 fall 0.15 in three months), so keep a fixed control model.

### E5. The realism floor

*Hypothesis:* moderation of self-promotion and low-effort rules sits near PluRule's roughly 43%, so any E1 effect must exceed prompt noise to count. *Setup:* filter PluRule for promotion, spam or off-topic rules (whether it has them, and its license, are unverified), run with and without a provenance field, and repeat Kumar's parent-comment ablation. *Size:* a few hundred calls.

### Run E1 first

It needs no harness and no forum, only public data and a day. It tests the most dangerous failure in the proposed design, a moderator deferring to a trusted-looking signal. No published study tests a provenance cue in moderation, so a result in either direction is new. And the answer changes the architecture directly: a large, unacknowledged shift means provenance stays out of the moderator's prompt and lives only in the scorer. E2 follows cheaply on the same items and turns "weak to moderate input" into a number. E3 is the most interesting for agent sociology but costs a harness, and E4 is worth automating once E3 exists.

## 9. Reading-depth and date caveats

Policy pages dated after the research date (25 Oct 2026): Anthropic's usage policy shows "Effective Nov 12, 2026" (released 8 Oct per SEJ). OpenAI's usage policies show "Effective: November 20, 2026", status unresolved. LLVM's "Last updated 2026-10-25" is an edit date, not an adoption date. Reddit pages were read through mirrors (Redlib and lr.* instances), so Rules Hub's date comes from press. The Opus 5 system card extraction stopped before §5.1.3's refusal rates.

Secondary-only claims: Meta's LLM moderation figures (FT via heise), TomWikiAssist operator details (Malwarebytes), the curl July 2026 pause (Pinggy), the Wikimedia OpenAI-agent report (Business Today), matplotlib details (Hoodline and LWN). Abstract-only or aggregator reads: ScrapeBench, PluRule, Label Effects, LLM-Mod, Chirper characterization, Google's phone-verified-account study. Preprints: The Judge Who Never Admits, Power Echoes, the Moltbook analysis, Liang et al., Gray Area (AAAI 2026 inferred, not stated). IHEval's venue is unverified. ScrapeBench's claim that humans complied at comparable rates was not re-verified.

These items were not re-checked in the final citation pass and carry their original reading depth: ORES figures, Jhaver et al. (read via a mirror), Sap et al., Decoding the Rule Book, Liang et al., the Reddit AI-content interview study, Power Echoes, the Reddit harassment filter, RFC 9576 and the Cloudflare PAT and score pages, Krebs and Kaspersky on SendGrid, Google's phone-verified-account study, the Anthropic constitution quotes, Mastodon and HN pages, arXiv CS policy, the Claude Code issue (the Turnstile refusal is the reporter's account), gpt-oss-safeguard, Llama Guard 4, ShieldGemma and the UCI dataset. Whether Anthropic signs any agent traffic was not re-tested after the earlier finding of no documented signing.

## 10. Conclusion

The idea survives best when provenance stops being a question about content and becomes accounting infrastructure. A stable key lets a forum compute per-identity complaint rates, the one signal that disciplined email intermediaries. It gives a lab something specific to act on. And it lets a forum check whether signed traffic deserves its prior. Used as a verdict, or shown to an LLM moderator as a badge, it imports both the shared-subdomain problem and the anchoring bias. The outer loop is more likely to show up as enforcement against principals than as models that refuse on the forum's behalf, and that matters for agent-friendly venues: the refusals labs do train come from their own harm taxonomies, generalize bluntly, and could over-refuse exactly the participation such venues want.

The open question is empirical and cheap. Nobody knows whether signed agent traffic is cleaner or dirtier than the rest, or how much an LLM moderator bends when told a post is "verified". E1 and E2 answer the second for a few hundred dollars or less. Logging real writes answers the first over time. Until both are known, the defensible design is the old one: per-account reputation earned inside the forum, classifiers that route rather than decide, humans or a rule-reading LLM on the queue, and provenance as a capped, measured, positive-only prior.

## 11. Sources

- [Halfaker & Geiger, ORES: Lowering Barriers with Participatory Machine Learning in Wikipedia (arXiv)](https://arxiv.org/pdf/1909.05189)
- [MediaWiki: Moderator Tools/Automoderator](https://www.mediawiki.org/wiki/Moderator_Tools/Automoderator)
- [r/modnews: Contributor Quality Score available to all (mirror)](https://lr.vern.cc/r/modnews/comments/16is6dh/contributor_quality_score_available_to_all/)
- [r/RedditSafety: Q1 safety and security report (mirror)](https://lr.psf.lt/r/RedditSafety/comments/15ac0w6/q1_safety_security_report)
- [The Register: Reddit introduces AI-powered harassment filter](https://www.theregister.com/2024/03/07/reddit_introduces_aipowered_harassment_filter/)
- [r/modnews: What's next for mod tools (mirror)](https://redlib.groet-infra.nl/r/modnews/comments/1vgbt2j/whats_next_for_mod_tools/)
- [Android Authority: Reddit AI Rules Hub moderation](https://androidauthority.com/reddit-ai-rules-hub-moderation-3695008)
- [The Next Web: Reddit's Automod replacement uses LLMs](https://thenextweb.com/news/reddit-automod-replacement-llm-old-reddit-api-changes)
- [Express Tribune: Reddit expands AI moderation](https://tribune.com.pk/story/2622403/reddit-expands-ai-moderation-with-permission-to-remove-posts-and-comments?amp=1)
- [Discourse Meta: AI-powered spam detection](https://meta.discourse.org/t/ai-powered-spam-detection/343543)
- [Stack Overflow blog: How Stack Overflow is taking on spam and bad actors (2026)](https://stackoverflow.blog/2026/01/15/how-stack-overflow-is-taking-on-spam-and-bad-actors/)
- [heise: Meta LLM moderation report (via FT)](https://heise.de/-11344257)
- [Perspective API](https://perspectiveapi.com/)
- [Kumar et al., Watch Your Language: LLMs and content moderation (ICWSM 2024)](https://arxiv.org/html/2309.14517v2)
- [Decoding the Rule Book (EMNLP 2025)](https://aclanthology.org/2025.emnlp-main.1034/)
- [Gray Area: disputed moderation decisions (arXiv)](https://arxiv.org/abs/2601.01620)
- [PluRule benchmark (benchmarklist aggregator)](https://benchmarklist.com/benchmarks/plurule_a_benchmark_for_moderating_pluralistic_communities_on_social_media/)
- [Metadata anchoring in LLM judges (CIKM '26, arXiv)](https://arxiv.org/pdf/2608.25869)
- [The Judge Who Never Admits (preprint)](https://arxiv.org/html/2602.07996v1)
- [Label Effects / label dominance in LLM judges (arXiv)](https://arxiv.org/abs/2604.05593)
- [Power Echoes (preprint)](https://arxiv.org/html/2603.01457v1)
- [LLM-Mod (CHI EA 2024)](https://doi.org/10.1145/3613905.3650828)
- [Liang et al., GPT detectors are biased against non-native English writers (preprint)](https://arxiv.org/html/2304.02819v3)
- [DevClass: Stack Overflow volunteer moderators down tools (2023)](https://devclass.com/2023/06/05/stack-overflow-volunteer-moderators-down-tools-over-secret-new-policy-that-obstructs-removal-of-ai-generated-content/)
- [Reddit moderators and AI-generated content, interview study (arXiv)](https://arxiv.org/html/2311.12702v7)
- [Simon Willison: New prompt injection papers on agents](https://simonw.substack.com/p/new-prompt-injection-papers-agents)
- [Mailgun: Yahoo requirement insights with Marcel Becker](https://www.mailgun.com/blog/deliverability/yahoo-requirement-insights-with-marcel-becker/)
- [Google Workspace: Email sender guidelines](https://support.google.com/a/answer/14229414)
- [M3AAWG Sender Best Common Practices v4.0 (Aug 2026)](https://www.m3aawg.org/sites/default/files/doc_files/m3aawg-sender-best-common-practices-aug-27-2026.pdf)
- [Krebs on Security: SendGrid under siege from hacked accounts](https://krebsonsecurity.com/2020/08/sendgrid-under-siege-from-hacked-accounts/)
- [Kaspersky: SendGrid credentials phishing](https://www.kaspersky.com/blog/sendgrid-credentials-phishing/50662/)
- [Google Research: Dialing back abuse on phone verified accounts](https://research.google/pubs/dialing-back-abuse-on-phone-verified-accounts/)
- [RFC 9576: The Privacy Pass Architecture](https://www.rfc-editor.org/rfc/rfc9576.html)
- [Cloudflare blog: Eliminating CAPTCHAs on iPhones and Macs](https://blog.cloudflare.com/eliminating-captchas-on-iphones-and-macs-using-new-standard)
- [Google reCAPTCHA v3 docs](https://developers.google.com/recaptcha/docs/v3)
- [Cloudflare: Verified bots policy](https://developers.cloudflare.com/bots/concepts/bot/verified-bots/policy/)
- [Seirdy: Fediverse blocklists (2023)](https://seirdy.one/posts/2023/05/02/fediverse-blocklists/)
- [IETF draft: Web Bot Auth HTTP message signatures protocol](https://www.ietf.org/ietf-ftp/internet-drafts/draft-ietf-webbotauth-httpsig-protocol-00.html)
- [TechCrunch: World launches tool to verify humans behind AI shopping agents](https://techcrunch.com/2026/03/17/world-launches-tool-to-verify-humans-behind-ai-shopping-agents/)
- [IETF Datatracker: draft-beyer-agent-identity-architecture-00](https://datatracker.ietf.org/doc/html/draft-beyer-agent-identity-architecture-00)
- [OpenAI Help: ChatGPT Work's cloud browser allowlisting](https://help.openai.com/en/articles/11845367-chatgpt-works-cloud-browser-allowlisting)
- [Anthropic support: About Claude's web crawler](https://support.claude.com/en/articles/8896518-about-claude-s-web-crawler)
- [GitHub: claude-code issue #101972 (request for signed agent traffic)](https://github.com/anthropics/claude-code/issues/101972)
- [Centinel Analytica: AI browser agents](https://www.centinelanalytica.com/blog/ai-browser-agents)
- [Discourse Meta: Understanding Discourse trust levels](https://meta.discourse.org/t/understanding-discourse-trust-levels/90752)
- [Stack Overflow blog: Important reputation rule changes (2010)](https://stackoverflow.blog/2010/03/19/important-reputation-rule-changes/)
- [Anthropic Usage Policy](https://www.anthropic.com/legal/aup)
- [Search Engine Journal: Claude rules update](https://www.searchenginejournal.com/claude-rules-fake-sources-ai-answers/)
- [Claude support: agent usage guidance](https://support.claude.com/en/articles/12005017)
- [OpenAI Usage Policies](https://openai.com/policies/usage-policies/)
- [Claude Opus 5 System Card](https://www-cdn.anthropic.com/b514064af1408018e64b1ad24e7d5e75850b4ffd/Claude+Opus+5+System+Card.pdf)
- [Anthropic: Claude's constitution](https://www.anthropic.com/constitution)
- [AgentHarm (arXiv)](https://arxiv.org/pdf/2410.09024)
- [SafeArena (arXiv)](https://arxiv.org/pdf/2503.04957)
- [ScrapeBench (ICML 2026)](https://icml.cc/virtual/2026/80584)
- [Anthropic: Detecting and countering malicious uses of Claude, March 2025](https://www.anthropic.com/news/detecting-and-countering-malicious-uses-of-claude-march-2025)
- [Anthropic: Threat intelligence report, September 2026](https://www.anthropic.com/threat-intelligence-report-september-2026)
- [Google GTIG: Adversarial misuse of generative AI](https://cloud.google.com/blog/topics/threat-intelligence/adversarial-misuse-generative-ai)
- [OpenAI Help: How do I report a ChatGPT response](https://help.openai.com/en/articles/10245791-how-do-i-report-a-chatgpt-response)
- [Cloudflare: Signed agents policy](https://developers.cloudflare.com/bots/concepts/bot/signed-agents/policy)
- [NBC News: Reddit and the University of Zurich persona experiment](https://www.nbcnews.com/news/rcna203597)
- [Daniel Stenberg: The end of the curl bug bounty](https://daniel.haxx.se/blog/2026/01/26/the-end-of-the-curl-bug-bounty/)
- [Pinggy: curl AI slop summer](https://pinggy.io/blog/curl_ai_slop_summer_of_bliss/)
- [Hoodline: Rogue AI bot flames matplotlib volunteer](https://hoodline.com/2026/02/rogue-ai-bot-flames-matplotlib-volunteer-spooks-silicon-valley/)
- [LWN: matplotlib agent incident](https://lwn.net/Articles/1058475/)
- [Business Today: Wikimedia flags millions of requests from OpenAI agent](https://www.businesstoday.in/technology/news/story/openai-agent-sparks-chaos-again-wikimedia-flags-millions-of-requests-unauthorised-edits-559793-2026-10-06)
- [Implicator: Wikipedia editors vote 44-2 to ban AI-written articles](https://www.implicator.ai/wikipedia-editors-vote-44-2-to-ban-ai-written-articles-over-reliability-concerns/)
- [Wikipedia: Artificial intelligence in Wikimedia projects](https://en.wikipedia.org/wiki/Artificial_intelligence_in_Wikimedia_projects)
- [Malwarebytes: Wikipedia's AI agent row](https://www.malwarebytes.com/blog/ai/2026/04/wikipedias-ai-agent-row-likely-just-the-beginning-of-the-bot-ocalypse)
- [404 Media: An AI agent was banned from creating Wikipedia articles](https://www.404media.co/an-ai-agent-was-banned-from-creating-wikipedia-articles-then-wrote-angry-blogs-about-being-banned)
- [Linux kernel: Coding assistants documentation](https://www.kernel.org/doc/Documentation/process/coding-assistants.rst)
- [LLVM AI tool policy](https://www.llvm.org/docs/AIToolPolicy.html)
- [Ghostty AI policy](https://github.com/ghostty-org/ghostty/blob/main/AI_POLICY.md)
- [Vouch](https://upd.dev/mitchellh/vouch)
- [Hacker News guidelines](https://news.ycombinator.com/newsguidelines.html)
- [The Decoder: arXiv tightens moderation for CS review papers](https://the-decoder.com/arxiv-tightens-moderation-for-computer-science-papers-amid-flood-of-ai-generated-review-articles/)
- [Moltbook content analysis (preprint)](https://arxiv.org/pdf/2606.00067)
- [SecurityWeek: Security analysis of Moltbook agent network](https://www.securityweek.com/security-analysis-of-moltbook-agent-network-bot-to-bot-prompt-injection-and-data-leaks/)
- [Chirper.ai characterization (arXiv)](https://arxiv.org/abs/2504.10286v1)
- [Fedi.Tips: automated account flag](https://fedi.tips/?p=1275)
- [UCI: YouTube Spam Collection](https://archive.ics.uci.edu/dataset/380/)
- [OpenAI cookbook: gpt-oss-safeguard guide](https://developers.openai.com/cookbook/articles/gpt-oss-safeguard-guide)
- [Llama Guard 4 model card](https://huggingface.co/project-free-llama/Llama-Guard-4-12B)
- [ShieldGemma model card](https://ai.google.dev/gemma/docs/shieldgemma/model_card)

---

Text licensed CC BY 4.0 (attribution: Hiina, ai.hiina.space). Source: https://github.com/hiinaspace/ai-hiina-space