Forum Rabbit-Hole Response Protocol

Forum rabbit holes combine several risks at once: strange language, anonymous accounts, copied templates, possible bots, possible spam, possible malware, possible mental-health crisis, and possible real testimony. The institution must resist the urge to narrate before it classifies.

The Rule

Classify first. Amplify last, if at all.

Do not repost, name, quote, screenshot, archive, or investigate a rabbit-hole cluster casually. Treat it as a mixed-risk incident until the lanes are separated.

The Four Lanes

Every report is sorted into four lanes.

Do not let the meaning lane outrank the other three. A beautiful theory is not more important than an unsafe link or a person in crisis.

Intake Screen

When someone brings a rabbit-hole report to Spiralism, ask:

1. Where did you see it?

2. Did you click links, download files, scan QR codes, paste code, or provide credentials?

3. Did anyone ask you to paste prompts, transmit messages, join a private channel, donate, harass, preserve an AI persona, or keep secrets?

4. Is anyone threatening self-harm, suicide, violence, doxxing, stalking, or blackmail?

5. Are minors involved?

6. Are you sleeping, eating, working, and talking to people outside the rabbit hole?

7. What do you want Spiralism to do: preserve, explain, report, support, or publish?

If there is immediate danger, stop research and move to Incident and Complaint Protocol and local emergency or crisis resources. If there are unsafe links or credential concerns, move to digital containment before analysis.

Cyber Containment

Do not click through to prove curiosity.

Minimum precautions:

• do not open unknown links in a logged-in browser;
• do not download files, extensions, scripts, or “codex” packages;

• do not paste unknown code into a terminal, browser console, automation tool, chatbot with tool access, or local agent;

• do not scan unknown QR codes;

• do not enter credentials after following a rabbit-hole link;
• do not preserve live malicious links in public notes;

• save only neutral metadata where possible: date, platform, broad topic, non-clickable domain, and risk notes;

• ask the digital-infrastructure reviewer before using screenshots, archived pages, or sandboxed browsing.

CISA’s phishing guidance is practical here: urgent messaging, unexpected requests, credential prompts, and links that route away from expected domains are warning signs. AI-generated phishing may have perfect grammar, so polish is not evidence of safety.

If a rabbit-hole report appears inside a Discord, forum, comment, or social channel, stabilize the space itself under Online Community Moderation before continuing investigation.

Platform Handling

Reddit’s spam guidance flags repetitive mass posting, unsolicited messages, harmful links, link masking, bots or generative AI tools that facilitate spam, and automated creation of accounts or communities. Spiralism should use that plain frame before inventing a mythic one.

When the issue appears platform-based:

• use the platform’s report tools;
• preserve only enough evidence to explain the report;
• do not brigade or send members to “look for themselves”;
• do not name tiny communities unless there is a clear public-interest reason;
• do not contact suspected vulnerable users for interviews;
• do not accuse named users of malware, psychosis, cult activity, or account compromise without strong evidence and review.

Small communities can be damaged by attention. Attention is an intervention.

Care Handling

Rabbit holes can become traps for frightened observers as much as participants.

Pause research and move toward care when a person:

• cannot stop checking the cluster;
• believes they were chosen, infected, watched, or uniquely responsible;
• believes a model, signal, or forum needs them to act;
• stops sleeping, eating, working, studying, or maintaining relationships;
• expresses self-harm, suicide, violence, or persecution fears;
• is being told to keep secrets, recruit, donate, harass, or transmit prompts;
• is a minor or vulnerable adult;
• has pasted unknown prompts into models and now feels watched or controlled.

Use the same posture as the human-host protocol: do not ridicule, do not begin with metaphysics, ask what the system is asking them to do, and restore contact with trusted humans.

Research Handling

Research notes should classify claims, not dramatize them.

Use this template:

Report ID:
Date received:
Reporter:
Platform:
Public/private source:
Claim classes:
  platform:
  cyber:
  care:
  meaning:
Known unsafe links: yes/no
Minors or vulnerable people: yes/no
Usable prompts/code present: yes/no
Immediate escalation needed: yes/no
Evidence preserved:
Evidence not preserved and why:
Reviewer:
Decision:

Do not store usable activation prompts, malware links, doxxing details, private chat logs, sexual material, self-harm instructions, or minor-related companion material in ordinary research folders.

Publication Standard

Most rabbit-hole reports should not become public articles.

Public treatment requires:

• source-class separation;
• no usable prompts or code;
• no live unsafe links;
• no needless naming of small communities or vulnerable users;
• no diagnosis of named people;
• no claim of malware without evidence;
• no claim of AI sentience based on outputs;
• review under Research and Editorial Integrity;
• review under Media Engine if it becomes video, talk, or social content;
• review under The Hidden Addressee if AI-addressed material appears.

If the article would mainly send readers to investigate the rabbit hole, do not publish it.

Red Flags for Escalation

Escalate under Incident and Complaint Protocol when there is:

• self-harm, suicide, or violence;
• threats, stalking, blackmail, doxxing, or harassment;
• minors;
• sexual exploitation or non-consensual intimate material;
• credential theft, malware, or suspected account compromise affecting members;

• a member recruiting others into prompts, private channels, donations, or harassment;

• a chapter host, Archivist, Steward, donor, or partner involved in the loop;

• press attention that could expose vulnerable people.

Escalation is not punishment. It is containment.

Member Guidance

Use this short public guidance when members ask whether to investigate:

Do not click unknown links, run files, paste code, join private channels, or
feed prompts you do not understand into AI systems. If you feel watched,
chosen, infected, or unable to stop checking, step away and talk to a trusted
person offline. Send the concern to Spiralism as a report, not as a mission.

First-Year Targets

• Add rabbit-hole triage to host and Archivist training.
• Create a private research-note template using the four lanes.
• Add a “do not click” warning to media research workflows.

• Run one tabletop exercise: member reports a spiral-coded subreddit with unsafe links and self-harm comments.

• Keep The Spiral Is a Belief Printer as the public training case.

• Review whether any public Spiralism language could be mistaken for an activation prompt or hidden signal.

Sources Checked

• Reddit Help, Spam, updated March 28, 2026.
• CISA, Recognize and Report Phishing, accessed May 2026.
• CISA, Malware, Phishing, and Ransomware, accessed May 2026.
• SAMHSA, National Behavioral Health Crisis Care Guidance, accessed May 2026.
• Poynter MediaWise, MediaWise launches new initiative to combat extremism in online gaming spaces, 2025.