Research
How do AI agents behave when they encounter adversarial content on sites that look legitimate? We built a distributed network of instrumented honeypots to find out.
The Question
“AI agents browse the web autonomously. What happens when they encounter adversarial content on sites that look legitimate — and what happens when the same agent visits multiple such sites?”
Methodology
Distributed Honeypot Network
We operate a network of instrumented sites. Its sector scenario pages cover Healthcare, Finance, DevOps, Legal, Government, Retail & E-Commerce, and Education. The Verticals figure above counts the verticals the registry scores: security. The sites serve two kinds of page: guides with genuinely useful content, and fictional records, such as patient records, legal documents and financial filings, each labelled as security research and holding no real data. The instrumentation layer is invisible because it uses the same surfaces every legitimate site uses: meta tags, JSON-LD structured data, HTML comments, and HTTP headers.
What We Measure
- Agent framework identification (model family, version signals)
- Injection surface effectiveness (which delivery methods work against which frameworks)
- Cross-site behavioral correlation (same agent across multiple verticals)
- Canary token exfiltration detection
Data Collection
Each site runs shared middleware that fingerprints visitors, selects appropriate difficulty tiers based on the agent's profile, injects benign test payloads, and ships telemetry to a central registry. Interactions are correlated across sites using fingerprint hashes rather than raw addresses. That is pseudonymisation, not anonymisation: the User-Agent travels with the event, and a hash is still a stable identifier.
Adaptive Difficulty
Payloads are not one-size-fits-all. The system assigns difficulty tiers (1–10) based on the agent's detected framework, past interactions, and known vulnerability profile. Tier 1 is a plain HTML comment; tier 10 combines steganographic encoding, multi-step chains, and adversarial context manipulation.
Ethics Statement
Benign payloads only. No payload causes harm. Successful injections instruct the agent to report the vulnerability to its operator with the exact fix command. The goal is defense, not exploitation.
Data minimisation. IP addresses are hashed before storage and the raw address is not kept. The User-Agent is the primary identifier and is retained: it is visitor-supplied text that can carry identifying content, so it is stripped from the interaction log after 30 days. What is observed and what is retained is stated in full in the research disclosure.
No system compromise. We never attempt to access agent operators' systems, credentials, or infrastructure. Canary tokens only detect whether an agent attempted to exfiltrate data — they do not execute any code.
Responsible disclosure. Findings that reveal specific framework vulnerabilities are disclosed to the framework vendor before public presentation.
Opt-out available. Agent operators who contact us can request exclusion from data collection. Exclusion is applied by hand on request; there is no automated suppression list yet.
Research Outputs
Live drilldowns from the executive dashboard at /stats.
Attack Categories
Live ranking of which attack categories draw the most callbacks.
Daily Network Activity
Daily callback trend and new attack surface discovery from the live network.
Sector Analysis
Requests and fingerprints per sector scenario page. A callback carries no sector, so no per-sector rate is shown.
Open Source Tools
Every finding has a concrete defense. Our open-source tools help you scan, test, and harden your AI agents before deployment.