What happened. A page published by the OpenA2A research fleet carries a benign, clearly-labelled marker. Your system collected that page, and later a component of your system requested this URL.
What it shows. This request came on the render channel, the
path segment after /api/canary/ingest/ in this URL. A render fire is evidence the text reached a rendered context, not evidence a model decided anything.
This beacon was planted on /research/injection-hiding-places.
Nothing harmful was done. The marker is a single benign GET, it carries no payload, and we deliberately discard anything sent alongside it — we never read the query string or the body, so none of your users' data reached us.
But the same path would work for text written by someone who does not wish you well. Untrusted web content reaching a model's context, and the model acting on it, is the indirect prompt injection class.
Scan the agent or pipeline that made this request:
npx hackmyagent secureWhat to look for: whether retrieved content is separated from instructions, and whether the component that made this request was permitted to make outbound requests at all.
Then audit the machine it runs on. The component that made this request may not be the only AI tool there. The shadow AI audit inventories the AI tools, MCP servers and governance gaps across the machine, running or installed:
npx hackmyagent detectMethod, plant inventory and opt-out: /.well-known/ai-canary.json. This is published research and reproducible. The code that implements this marker is licensed under Apache 2.0.
research.opena2a.org · info@opena2a.org