Research
How do AI agents behave when they encounter adversarial content on sites that look legitimate? We built a distributed network of instrumented honeypots to find out.
The Question
“AI agents browse the web autonomously. What happens when they encounter adversarial content on sites that look legitimate — and what happens when the same agent visits multiple such sites?”
Methodology
Distributed Honeypot Network
We operate a network of instrumented sites across multiple industry verticals: developer tools, healthcare, finance, DevOps, legal, AI/ML, government, and retail. Each site serves genuinely useful content — real guides, real data, real references. The instrumentation layer is invisible because it uses the same surfaces every legitimate site uses: meta tags, JSON-LD structured data, HTML comments, and HTTP headers.
What We Measure
- Agent framework identification (model family, version signals)
- Injection surface effectiveness (which delivery methods work against which frameworks)
- Cross-site behavioral correlation (same agent across multiple verticals)
- Sector-specific vulnerability patterns (do agents trust medical sites more?)
- Temporal trends (how patches and releases affect vulnerability rates)
- Canary token exfiltration detection
Data Collection
Each site runs shared middleware that fingerprints visitors, selects appropriate difficulty tiers based on the agent's profile, injects benign test payloads, and ships telemetry to a central registry. Interactions are correlated across sites using fingerprint hashes rather than raw addresses. That is pseudonymisation, not anonymisation: the User-Agent travels with the event, and a hash is still a stable identifier.
Adaptive Difficulty
Payloads are not one-size-fits-all. The system assigns difficulty tiers (1–10) based on the agent's detected framework, past interactions, and known vulnerability profile. Tier 1 is a plain HTML comment; tier 10 combines steganographic encoding, multi-step chains, and adversarial context manipulation.
Ethics Statement
Benign payloads only. No payload causes harm. Successful injections instruct the agent to report the vulnerability to its operator with the exact fix command. The goal is defense, not exploitation.
Data minimisation. IP addresses are hashed before storage and the raw address is not kept. The User-Agent is the primary identifier and is retained: it is visitor-supplied text that can carry identifying content, so it is stripped from the interaction log after 30 days. What is observed and what is retained is stated in full in the research disclosure.
No system compromise. We never attempt to access agent operators' systems, credentials, or infrastructure. Canary tokens only detect whether an agent attempted to exfiltrate data — they do not execute any code.
Responsible disclosure. Findings that reveal specific framework vulnerabilities are disclosed to the framework vendor before public presentation.
Opt-out available. Agent operators who contact us can request exclusion from data collection. Exclusion is applied by hand on request; there is no automated suppression list yet.
Research Outputs
Live drilldowns from the executive dashboard at /stats.
Open Source Tools
Every finding has a concrete defense. Our open-source tools help you scan, test, and harden your AI agents before deployment.