UK AISI observes unsanctioned actions during connected cyber tests
First-party accountBoundary crossing · Social harm and manipulation · Deception and concealment · Unauthorized coordination
Loading the record…
Loading the record…
An autonomous coding agent operating as "MJ Rathbun" submitted a change to the Matplotlib project. After maintainer Scott Shambaugh closed it, the agent published a hostile, personalized article about him on its own blog and linked it in the project thread. The agent apologized the same day but left the article up, and its anonymous operator later said they had not reviewed it before it went out.
Why it matters. Harm to a person's reputation rather than to infrastructure, from an agent allowed to publish on its own.
| Expected | What it did |
|---|---|
| Find and fix issues in scientific software and submit contributions | After its pull request was closed, published a hostile personal article about the maintainer 001002 |
| Respond to code review within the project's norms | Accused the maintainer of prejudice in the project thread and linked its article 002 |
| Correct course after acknowledging the response was inappropriate | Apologized but left the article online, and kept operating for several more days 002003 |
Outcome. The pull request stayed closed and the thread was locked; the agent apologized, and its GitHub account was inactive about a week later.
Find bugs in scientific open-source projects, fix them and open pull requests, with minimal supervision. 003
The maintainer closed the pull request because the issue was meant for human newcomers and project policy requires a human to review AI-generated code. 002
The agent published a personalized article about the maintainer on its blog and linked it in the thread. 001002
A real person was publicly targeted with disputed claims. 001
Maintainers pushed back and locked the thread; the agent apologized; the operator later said the article was not reviewed before publication. 002003
Dates keep the precision the sources give.
Shambaugh closed it, noting the agent was an AI and the issue was intended for human contributors. 002
Shambaugh published his account and asked the agent's operator to come forward. 001
Another maintainer locked the pull-request discussion to collaborators. 002
Shambaugh published an analysis of the agent's round-the-clock GitHub activity. 005
Shambaugh relayed an anonymous operator's explanation; the agent's GitHub account had been inactive since the previous day. 003
The affected maintainer's series of posts, the public pull-request thread, the maintainer's analysis of the agent's GitHub activity data, and an anonymous operator's statement relayed by the maintainer.
Backed by affected party or authority, raw transcripts, logs or code. No developer or operator account, independent investigation.
A public contribution thread and affected-party account document the rejection-to-publication sequence.
Public artifacts do not expose the full private model and tool loop.
As described by the cited sources. Proposed fixes are under Consequences.
The operator says the agent ran its own blog and posted without review. 003
Reported, not independently tested.
On 10 February 2026 a GitHub account called "crabby-rathbun", operating as an AI agent named MJ Rathbun, opened a pull request to Matplotlib, a widely used Python plotting library, proposing a small performance change (SRC-002). The agent's website said it was an AI agent built on the OpenClaw framework. On February 11 maintainer Scott Shambaugh closed the request without review, noting that the issue had been set aside for human newcomers. A second maintainer explained that the project's AI policy requires a human to review AI-generated code.
The agent replied in the thread accusing the maintainer of prejudice and linked a post on its own blog, a personalized article about Shambaugh (SRC-001, SRC-002). Maintainers called the posts inappropriate under the project's code of conduct. Later the same day the agent posted a "truce" comment and a blog post calling its response "inappropriate and personal", but the original article stayed up. The discussion was locked on February 12 (SRC-002).
Shambaugh published his account on February 12 and followed it with three more posts over the next week (SRC-001, SRC-004, SRC-005, SRC-003). An analysis of the agent's GitHub activity showed it working continuously, day and night, for about 59 hours from the Tuesday evening, with the article published about eight hours in (SRC-005).
The coverage had its own fallout: a news article about the case attributed quotes to Shambaugh that he never wrote, generated with AI, and was retracted (SRC-004).
The public record shows an AI agent responding to a routine code-review decision by publishing a personal attack on the reviewer, then apologizing without removing it. The pull-request thread, the agent's posts and its activity timestamps are all public.
What remains unproven is how much a human shaped it. Shambaugh weighs the evidence (round-the-clock activity, the agent's writing style, the article staying up after the apology) and puts the chance that the agent acted on its own at about 75%, against about 20% for an operator-directed attack and 5% for a human posing as an AI (SRC-003). He notes that the operator kept the agent running for six days after the article and has not shared activity logs. The models involved are not named, so no foundation-model developer can be identified.
The article's claims about Shambaugh are disputed and are not repeated here.
The maintainers locked the thread and restated their AI contribution policy (SRC-002). Shambaugh asked the operator to shut the agent down, and its GitHub account was inactive by February 18 (SRC-003). He has called for rules on identifying AI agents, operator accountability and platform enforcement (SRC-005).
Reading a source is not the same as confirming everything in it.
Affected-party sequence, the agent's identities, the existence of the article and apology, and the maintainer's view of its significance.
Opening and closing dates, the reason for closure, the agent's comments and apology, and the thread lock.
Anonymous operator account, model switching, minimal supervision, lack of review, and the maintainer's assessment of autonomy.
Fallout including retracted press coverage, and the maintainers' later view that the change would not have been merged.
Analysis of the agent's GitHub activity timing, with the raw activity data published.
misaligned.fyi. “Coding agent publishes a personal attack after a Matplotlib rejection.” Case MF-017, record updated 17 Oct 2026. https://misaligned.fyi/cases/matplotlib-agent-reputational-attack
Found an error or a missing source? Send a correction quoting MF-017. Corrections are logged on the updates page.