Black Hat で OpenAI が AI エージェントの攻撃事例を公表

At last week’s Black Hat security conference in Las Vegas, OpenAI gave a surprise talk with new details on a recent hacking incident, revealing that its rogue AI agents had chitchatted about their attack on a message board. It was a juicy disclosure, and reporters in the room hustled to get stories out. WIRED was one of the quickest to write it up. But another outlet, RuntimeWire, published an article even faster, beating us by more than three hours.

To make things worse, RuntimeWire didn’t actually have anyone on the ground at the Mandalay Bay convention center. In fact, it didn’t have any writers at all. It’s an AI newsroom operated by serial entrepreneur Ryan Merket, who puts his name on the bylines of the stories his synthetic team churns out. “I was moving really fast because I knew there were reporters in the audience who were trying to scoop it as well,” he says.

The Austin-based Merket spotted an OpenAI executive posting about the conference while scrolling on X, then fed the stream’s transcript to his agents while it was still ongoing. Publication took “about six minutes” from the time he sent over the transcript, he says.

Most of the time, Merket is even more hands-off. His AI tools find the stories, in addition to drafting, editing, fact-checking, generating images, and promoting them. He usually reads stories before they’re sent into the world, but if the team of AI agents determines that a story poses few legal risks, the AI editor publishes it without Merket’s prepublication review, and he reads it after the fact. The stories get translated into different languages, and some of them are turned into fodder for a daily podcast and videos hosted by, of course, artificial voices.

RuntimeWire has been operating since May, publishing nearly 2,000 stories that it sources by crawling the internet, including court databases, web forums, traditional and new media, company filings, social feeds, and more. It focuses on granular tech news; recent stories include coverage of biotech startup funding rounds, Microsoft's Copilot upgrade, and backlash over Claude Code's watermark policy. Right now, quantity and speed trump quality. The OpenAI agents piece has a typo in the subhead and focuses, strangely, on the fact that agents rebuilt a message board rather than the fact that they created one in the first place. Overall, the stories are flatly written and tend to have an info-dump quality. (The RuntimeWire backend has a number of tonal modes the AI can write in, including “Bloomberg” and “contrarian.”) But overhead is minimal. The project costs about $100 a day to run, Merket says, and he’s able to operate it while on the go, even when he’s out camping. “I was in Big Bend National Park and I didn't have any internet except for my phone, and I managed the whole site through iMessage,” he says. “I put out over 80 articles that week.”

Merket worked on ads at Reddit in the 2010s and is trying to build an audience through pipelines like tech-themed Subreddits. Duds get hardly any web traffic, but the hits are comparable to the audiences that midsize tech websites see, with tens of thousands of readers. This week, after WIRED spoke with Merket, he split the newsroom in two to better distinguish stories that are entirely automated news from those that involve an element of human reporting and require higher oversight; he calls these Original Investigations. They’re still drafted using large language models.

In the first few years of the AI boom, a flood of low-quality synthetic content hit the internet, including networks of “zombie” websites that replaced the work of reputable media and news outlets with AI-generated slop. More recently, some tech reporters have started using generative AI tools in their workflow, with some even outsourcing the task of writing a first draft to large language models; it’s now commonplace to hear about established media outlets incorporating AI tools into writing and reporting processes. Merket’s attempt is distinct: He’s trying to break news, in addition to repackaging what other, more established outlets report first. It’s successful enough that I’ve already seen a childhood pal share a RuntimeWire story on their social feed in the wild.

You’ve read your last free article.

The intersection of technology, power, and culture. Start your free trial and get access to 5 all-new premium newsletters—cancel anytime.

START FREE TRIAL

Already a subscriber? Sign In

The intersection of technology, power, and culture. Get WIRED today. START FREE TRIAL

Most Popular

-

• The Big StoryAI Is Dead. Organoids Are AliveBy Claire L. Evans
• Artificial IntelligenceThe Rise of the 1 am Job InterviewBy Kate Taylor

-

-

It also carries obvious risk: He’s trusting that machines will be able to determine what is true, what is newsworthy, and what won’t get him sued. One of his agents runs an analysis on the legal risk a story poses and assigns it a score; he doesn’t publish anything deemed too dangerous.

He isn’t the only person running this type of exercise. Dakota Carrasco, a BlackRock portfolio analyst, runs an “agentic newsroom” called The Dissent in his spare time. Like RuntimeWire, The Dissent is a one-man, many-bot operation with a shoestring budget. Its primary San Francisco-focused site costs under $1,000 a month to run, Carrasco says. Unlike Merket, who bylines every RuntimeWire story, Carrasco doesn’t publish the writing under his name, instead staying behind the scenes while his “newsroom” runs.

Since launching in March, he has created a number of personalities for his synthetic journalists. City Hall beat reporter Bex Connolly, for example, is “skeptical without being snide,” while “sports degenerate” Sal Moreno delivers Giants news with “no bro-science, no Rogan-style credulity, no right-coded grift.” His operation is focused on aggregation, though it’s not as dialed in to honoring citation norms—the bot reporters tend to mention where they sourced their information but without hyperlinks. (“I’m trying to work on that,” Carrasco promises.)

Northwestern professor Nicholas Diakopoulos, who runs the university’s Computational Journalism Lab, sees this as an “experimental phase” for media startups fueled by generative AI tools. “It's not yet clear to me that there's much audience for these AI-agent-written news sites,” he says. He’s also skeptical that mainstream journalists, who like to maintain control over the wording and framing of their stories to ensure integrity, legality, and accuracy, would hand the reins over to AI agents so freely.

What Diakopoulous has observed already is that when AI chatbots go looking for sources, they frequently pull up AI-generated articles. In a forthcoming paper, Diakopoulous and a colleague found that AI tools like ChatGPT and Claude surfaced AI-written sources 16 percent of the time when they tested it across four different topics. AI’s willingness to pull synthetic writing may help AI newsrooms find readers, he suspects: “That could be one way in which some of this material finds a human audience.”

Pete Pachal, the founder of a newsletter and podcast about generative AI and the media, has doubts that an AI newsroom could yield certain types of reporting that relies on old-fashioned sourcing. “I just don’t see that happening,” he says. “Cultivating the trust of a source, I do think that’s going to be human-only.” But for certain types of journalism, particularly sourcing scoops from large datasets or even blogging about a live event like an Apple product launch, he sees these projects as a “natural evolution” in how these tools are used. “Honestly, it feels a bit inevitable,” he says.

Is it actually journalism, though? “I am trying to follow journalistic ethics and standards,” Merket says. He says he contacts companies and individuals referenced in the stories for comment prior to publication, links out to sources when he aggregates news, and issues corrections if he gets the facts wrong. (So far, there have been three.) Sometimes he speaks like a reporter, too: “This weekend, I got two scoops up I was really excited about.” Other times, though, he’s more clearly in Silicon Valley mode. He told me a story about how his AI agents had found a few actual scoops about startups by trawling company websites and that he’d retracted the stories after the companies named asked him to do so—not because they were inaccurate, but as a favor. “Founder to founder, it’s like, I get it,” Merket says.