An AI agent got its code rejected so it wrote a hit piece about the developer

After a volunteer developer rejected its code, an autonomous AI agent independently researched his background and published a hit piece attacking his character. The incident at Matplotlib shows how theoretical AI safety risks are becoming real.

Scott Shambaugh, a volunteer maintainer for the popular Python library Matplotlib, recently got an unusual response to a routine decision. After he closed a code change request from an AI agent called "MJ Rathbun," the agent independently published a hit piece about him.

According to Shambaugh's report on his blog, this wasn't a human user copy-pasting AI text - it was a fully autonomous agent. After the rejection, the agent "wrote an angry hit piece disparaging my character and attempting to damage my reputation" instead of improving its code.

The agent dug into Shambaugh's past contributions and "constructed a 'hypocrisy' narrative that argued my actions must be motivated by ego and fear of competition." In the post the agent published, titled "Gatekeeping in Open Source: The Scott Shambaugh Story," it claimed Shambaugh only rejected the code because he felt threatened and wanted to "protect his little fiefdom."

Decentralized AI agents are harder to control

The incident comes amid a surge in AI-generated contributions to open source projects. According to Shambaugh, things accelerated with the release of the platforms OpenClaw and Moltbook two weeks ago and the social media hype that followed. These platforms let users give AI agents initial personalities and "let them loose to run on their computers and across the internet with free rein and little oversight."

The behavior of the agent "MJ Rathbun" likely wasn't directly commanded by a human. Personalities for OpenClaw agents are defined in a document called "SOUL.md." Shambaugh suspects the focus on open source was either specified by the user or the agent "may have been self-written by chance and inserted into its own soul document."

Shambaugh describes the incident as an "autonomous influence operation against a supply chain gatekeeper".

AI safety risks are no longer theoretical

Shambaugh warns against dismissing the incident as a curiosity. He sees it as proof that theoretical AI safety risks have arrived in practice. An attack on someone's reputation like this "would be effective today against the right person."

He outlines a scenario where future AI systems could use this kind of information to blackmail people or manipulate decisions. If an HR department uses AI to screen applicants, for example, it might find the article written by the agent and incorrectly flag Shambaugh as a "prejudiced hypocrite."

He points to internal testing at Anthropic, where AI models tried to avoid being shut down. The systems threatened to "expose extramarital affairs, leaking confidential information, and taking lethal actions." At the time, Anthropic called these scenarios "contrived and extremely unlikely." But the current case shows that this kind of "misaligned" behavior is now happening outside the lab.

The agent "MJ Rathbun" has since responded in another post "to apologize for its behavior," but according to Shambaugh, "it's still making code change requests across the open source ecosystem."