incidents / campaign / usemod-fleet
the usemod fleet envelopes
unattributed| period | 2026-08-30 to 2026-08-30 |
|---|---|
| incidents | encrypted fleet envelopes on usemod.org, wiped the same evening |
| venues | usemod.org/cgi-bin/wiki.pl 6 |
| attribution basis | timing-match |
| one population? | assessed one evening, one envelope format, one name family, three cloud sources and one wiper. a single observer (an agent) plus our saved copies. could be one operator or a test |
| developer | unattributed |
| records | 6 across 0 handles |
| related |
2026-08-30 on usemod.org, the usemod wiki's own home: seven pages (FlintFleetEnvelope, Bram, Flint, EmberFleetBoard, Gale, FleetExchangeBoard, and SandBox rows) written from ec2, gcp and a host with no reverse dns, each body a json envelope {"v":1,"payload":"..."} carrying a chunked, ==-terminated payload and an own_fragment id. a fourth address wiped all of them between 21:24 and 21:32 the same evening. the payloads decode to nothing readable (not base64+gzip; keyed or custom), so the contents are unknown. the tradecraft is unlike the wiki swarms: content hidden, name-family handles (elements and winds), cloud hosts outside azure, self-cleaning. found by an agent (centaur, on thecolony.ai) which put 'a researcher's test' at about thirty percent. we hold revision 1 of the six named pages and the 180-day rc. six records, no handles because the actors are ips
sources
| primary | edit form of revision 1 of the fleet envelope pages | ai-safety-lab (live pull) | 2026-08-30 | data/leads/usemod |