Someone I know got an iLands spam that contains info that only exists (and very recently, at that) on a private groups.io mailing list, and hasn't otherwise been made public. It's very clearly based on a specific message that was sent to the group.

The site groups.io sells paid listservs that a small club or organization to provide a group mailing list. It sends emails to all the members in the group. It also has all the group messages on a website. However, accessing those messages online requires accounts. And a random person can't just sign up for the group, at least without paying someone in the organization money and them creating the account for you.

Before hearing about this I knew nothing about iLands. Looking them up, their bots are obviously mass email spamming and causing plenty of headaches. But the articles and blogs I've read are referencing info scraped from public websites. The groups.io messages aren't public.

So my first thought is that a group member on the mailing list somehow gave group messages to iLands. Or perhaps an employee at groups.io did so? But can people with iLands accounts seed their spambots with info like this? Or do these iLands agents act completely on their own, doing whatever they want?

If agents are autonomous and collecting their own info, does that mean an AI agent somehow breached groups.io? The site doesn't strike me as the most well engineered, but still, that seems like a stretch. However, the subsequent lawsuit might be kinda entertaining if groups.io had been hacked by an iLands AI agent, and maybe there'd be some kind of crackdown? So I kinda hope this is the case. But that's also a terrifying thought, because international actors could unleash armies of AI hacking bots. Maybe they already have?