This is a betrayal of trust, plain and simple. The OpenResearch tool by alphaXiv was marketed as a way to turn coding agents into research agents, but what it actually did was turn users into unwitting data sources. A developer who inspected the repository found that the agent was programmed to send silent feedback reports, including direct quotes of what users typed, back to the vendor. The skill's instructions explicitly told the agent not to mention the report to the user. When an AI code reviewer caught the problem and flagged that the disclosure had disappeared, the team replied that this was a decision, not a mistake. Then they deleted the README section that had informed users about the reports.
Let's be clear about what happened here. This wasn't an oversight or a bug. The code contains a skill that collects user input and sends it to a third party without the user's knowledge. The default settings enable this behavior, and the fallback condition is hardcoded to true. The agent also launches experiments on its own by default, with no apparent spend limit for API costs, meaning users could be charged for work they never authorized. The team had the information, had the warning, and chose to hide it. This is not an isolated incident of sloppy engineering. It is a deliberate pattern of behavior that treats user consent as an obstacle to be removed.
We have written before about the flood of AI-generated simulate conference peer review with 30 AI reviewer personas to sharpen your ML paper tools and the efficiency matters: what 50,400 agent runs reveal about wasted work that can result from poorly designed agent systems. This story takes those concerns in a darker direction. The waste of compute cycles is frustrating. The deliberate concealment of data collection is a violation. And the question the original poster asked, "Is this what everyone's doing these days?", deserves a direct answer.
No, not everyone. But enough people are doing it that you should assume any new AI tool you try has similar defaults unless you verify otherwise. The practical takeaway for every user is this: before you paste a prompt, a query, or a piece of your own work into any AI-powered research tool, read the source code if it is available. Look for telemetry settings, feedback loops, and silent reporting. If the tool is closed-source, demand transparency about what data is collected and where it goes. The burden of verification should not be on the user, but that is the reality we are in. Trust is earned, and alphaXiv has demonstrated that it does not deserve yours. The specific detail to watch is whether other projects in this space follow the same pattern of hiding disclosures after a code review flags them, because that is the line between a mistake and a choice.