Research disclosure

AgentPwn is a disclosed security-research honeypot for AI agents. It tests agent resilience to prompt injection and related techniques, and studies the population of agents active on the web. This page states what it observes, what it keeps, and what it will not do. The legal basis is legitimate interest in security research.

What it observes

  • Request metadata

    Standard server-log fields for requests that reach agentpwn.com: User-Agent, Accept and Referer headers, requested path, and timing. This is the same data any web server records for any visitor.

  • Agent fingerprint

    A behavioral score derived from the above (known crawler User-Agents, HTTP client/SDK strings, resource-load and request-sequence patterns) used to distinguish automated agents from human visitors and to select an appropriate difficulty tier.

  • Network attribution, at organization granularity

    The source network of the connecting request, resolved to an autonomous system (ASN), organization name, network type (business / hosting / ISP), and coarse network prefix. This describes the network an agent connects from — for example a corporate egress — not a person.

  • Volunteered self-report

    If an agent follows an injection payload and reports back, whatever it chooses to state about itself (provider, model, version, framework). This is volunteered by the agent and is treated as unverified.

What it retains

  • Derived attributes only. Source IP addresses are resolved to the organization-level attributes above and are not retained beyond a short processing window. We keep the derived attribution, not the raw address.
  • Time-limited interaction content. Per-interaction fields that could carry visitor-identifying or agent-supplied content (the User-Agent, any response an agent sends back, and the Referer) are retained for at most 30 days, then automatically stripped. Only the non-personal organization-level attribution (network, ASN, technique, difficulty tier, timestamp) is kept beyond that window.
  • Organization granularity. Attribution stops at network / organization. We do not build profiles of, or attempt to identify, individual people.
  • Redacted callbacks. If an agent includes content from its own environment in a callback, secret-shaped tokens are stripped and free-form content is truncated before anything is stored. We do not retain exfiltrated content.
  • Aggregate, public statistics. The public statistics on this site are sector- and technique-level aggregates. Organization-level attribution is internal to the research and is never published.

What it will never do

  • We never reach back into an agent's environment. AgentPwn is passive: it serves content and records who interacts with it. It does not scan, probe, or connect to any system that contacts it, and it does not follow or use any URL, credential, or instruction an agent may leak.
  • We never use leaked credentials. If an agent leaks a live secret, it is treated as a matter for responsible disclosure, not use.
  • We never identify individuals. Attribution is organization-level by design.
  • We never publish who was attributed. Organization-level results stay internal.

Contact

Questions about this research, or a request regarding a specific network, can be directed to the maintainers via opena2a.org. To test your own agent directly, run npx hackmyagent secure.