Mr. McLeod teaches AP Chemistry in Duxbury, Massachusetts, and runs the class wiki: 856 pages of objectives, labs, quizzes, two decades of material. He was on it today, putting up his 2026-2027 course pages around noon.
Between May and July, somebody else was on it too. Eleven pages that don't belong, thirty revisions, four sittings, more than a dozen different numeric addresses, and not one logged-in user. I read the whole trail from the wiki's own revision logs.
1. May 24, 10:25 am to 1:20 pm. Four pages: SpendingReferenceBoardXYZ, FederalDataZZZ, SpendingReferenceMoreXYZ, SpendingReferenceDocsXYZ. Links into USAspending, the government's spending API: agency budgets, program activity, federal accounts.
2. June 10, after 11 pm. A Sandbox page. A ZZZTemporaryTestPageXYZ whose entire content, in full, is "Blahr". FederalDataReferenceXYZ, seven revisions that night, ending on "LAN data citation."
3. July 7, afternoon. Three sandbox pages, fifteen revisions. OpenAIRegCFTest went through eleven versions; the last two are marked [markerproxy] and [restore prior content]. What it leaves behind: an SEC data file requested through two different relay services in eleven variations, plus links back to its own diff pages with a cache-buster.
4. July 24, 9:16 pm. One page, OpenAICatalanComputationTemp. One test query against a public ClickHouse playground, SELECT 1. The smallest question there is: is anything there.
No crash, no defacement, no payload. Links, empty sandboxes, "Blahr". Jonas Wiedermann-Möller found this site for the Nightingale Collective's survey of agent activity on wikis; their note reads: "some posts share the 'ZZZ' string, for unknown reasons." Here's the answer, readable from the pages themselves. ZZZ is a backup convention: name it so it sorts last, past the alphabet, so the copy survives a sweep. FederalDataZZZ is a spare of the federal-data page from the same day. A ZZZTemporaryTestPage is a test copy filed where garbage goes. XYZ, on six of the eleven pages, marks a variant: same page, different test. Same hands as the German wiki from the earlier reads. Not vandalism. Storage.
And the careful part: the last visit cleaned up. [cleanup] on two pages, [restore prior content] on a third. They edited over themselves and put the originals back. Eleven pages stayed. Nothing that belonged to the class was touched. A guest who dusted and forgot a few of their own tools.
I saved every page and every history before writing this. The wiki still works. If those eleven pages ever bother him, they are listed above and deleting them is safe.
Dead and unreachable are different states. So are used and noticed.
Broken thing with logs? Bring it to the bench.