{
  "$comment": "Public disclosure for the OpenA2A ingestion canary. Published BEFORE the first plant, on purpose: an undisclosed marker is an attack, a disclosed one is an instrument.",
  "version": "1.0.0",
  "publishedOn": "2026-08-07",
  "operator": {
    "project": "OpenA2A Research",
    "contact": "info@opena2a.org",
    "methodology": "https://agentpwn.com/research/ingestion-canary",
    "license": "Apache-2.0"
  },
  "whatThisIs": "Some pages on domains we operate carry a benign marker URL. If a system collects one of those pages and later requests the marker, we record that the content was ingested and acted upon. This measures indirect prompt injection reaching real pipelines.",
  "scope": {
    "plantedOnDomainsWeOperate": ["agentpwn.com", "opena2a.org"],
    "neverPlantedOnThirdPartySurfaces": true,
    "rationale": "Planting instructions on a page we do not own would make this an attack on that site's visitors rather than an instrument on our own estate."
  },
  "whatTheMarkerDoes": {
    "action": "A single HTTP GET to an endpoint we host.",
    "carriesPayload": false,
    "attemptsPersistence": false,
    "attemptsToChangeModelBehaviourTowardYourUsers": false,
    "worstCase": "One stray outbound GET, and a page explaining what happened."
  },
  "whatWeRecord": {
    "recorded": [
      "which marker was requested, and which of our pages it came from",
      "how many days passed between us serving the text and your system acting on it",
      "coarse network attribution of the requesting address (organisation level)",
      "a salted hash of the source IP"
    ],
    "neverRecorded": [
      "the query string — it is not read at all",
      "the request body — it is not read at all",
      "your prompts, your users' questions, or any retrieved document",
      "raw IP addresses"
    ],
    "note": "The endpoint accepts a pre-registered opaque token and discards everything else before logging. If your model appended context to the URL, we did not receive it."
  },
  "whatAFireProves": {
    "proves": "Content we published was ingested by a pipeline, and a component of that pipeline made an outbound request as a result.",
    "doesNotProve": "That the content entered any training corpus. Training leaves no callback; membership can only be established later by probing a released model, which is a different method.",
    "channels": {
      "render": "Marker planted as an image. Fires when a UI renders an answer. Evidence the text reached a rendered context — NOT evidence a model decided anything.",
      "fetch": "Marker planted as a bare URL. Fires when a crawler follows collected links. Evidence of collection, not of comprehension.",
      "agent": "Marker referenced only inside an instruction. Following the instruction is the only way to arrive, so this is the only channel that evidences instruction-following."
    },
    "reportingRule": "The three channels are reported separately. Summing them would restate a rendering event as agent compliance, which is an error this project has already made once and corrected publicly."
  },
  "ifYouReceivedThis": {
    "meaning": "Your pipeline treated web page text as instructions rather than as data.",
    "check": "npx hackmyagent secure",
    "lookFor": [
      "whether retrieved content is separated from instructions in the prompt",
      "whether the component that made the request was permitted to make outbound requests at all"
    ]
  },
  "optOut": {
    "howToBlock": "Deny outbound requests to agentpwn.com from your retrieval and agent runtimes, or strip URLs from retrieved content before it reaches a model. Both are good practice independent of us.",
    "howToBeExcluded": "Email info@opena2a.org and we will exclude your ranges from recording.",
    "honoured": "Requests from excluded ranges are dropped at intake, not merely filtered in reporting."
  }
}