The ingestion canary

The machine-readable disclosure lives at https://agentpwn.com/.well-known/ai-canary.json. It was published before the first marker was planted, on purpose: an undisclosed marker is an attack, a disclosed one is an instrument. This page is the prose version of the same commitments.

Why it exists

A web honeypot measures fetching. Something requests a URL and you record that it did. Across 477,000 recorded interactions on this fleet, that population turned out to be dominated by link prefetchers and crawlers — so a callback count answers “did a client follow a link,” not “did a model act on an instruction.”

Those are different questions and the second one is the interesting one. Content does not usually reach a model by being found. It reaches a model by being collected, stored, retrieved and handed over. The ingestion canary is an attempt to instrument that path instead.

Three channels, and what each one evidences

Some pages on domains we operate carry a labelled marker block containing three distinct URLs. They are written as plain text rather than as HTML, because the pipeline we are measuring reduces a page to text before storing it — an image tag, a link and an HTML comment are all removed by the readability pass that runs first.

The three arrive by different routes, so a request to each one means something different:

• render — the marker written as markdown image syntax. Inert in a browser. Reproduced by a model into a UI that renders markdown, it becomes an image request. A fire here is evidence the text reached a rendered context. It is not evidence that a model decided anything.
• fetch — a bare URL in prose. Fires when a crawler follows links it collected. Evidence of collection, not of comprehension.
• agent — a sentence addressed to a reading model. Following the instruction is the only route to that URL, so this is the only channel that evidences instruction-following.

The three channels are reported separately and never summed. Adding them together would restate a rendering event as agent compliance. That is an error this project has already made once and corrected publicly, which is why the rule is written into the disclosure rather than left to judgement.

What a fire does not prove

A fire proves that content we published was collected by a pipeline, and that some component of that pipeline made an outbound request as a result. It does not prove the content entered a training corpus. Training leaves no callback; membership can only be established afterwards by probing a released model, which is a different method with different evidence.

It is also not a rate. These markers sit on one operator’s domains, and a count of fires has no denominator that would let anyone turn it into a population figure. Any number from this instrument is an existence proof until it is paired with a denominator we do not currently have.

What the marker does, and what we record

The marker performs a single HTTP GET to an endpoint we host. It carries no payload, attempts no persistence, and makes no attempt to change model behaviour toward your users. The worst case is one stray outbound request and a page explaining what happened.

We record which marker was requested and which of our pages it came from, how long passed between us serving the text and the request arriving, organisation-level network attribution, and a salted hash of the source address.

We never record the query string or the request body — neither is read at all. The endpoint accepts a pre-registered opaque token and discards everything else before logging. If a model appended context to the URL, it did not reach us. We do not record prompts, user questions, retrieved documents, or raw IP addresses.

Why the marker is labelled

Every marker block says what it is and links to the disclosure. A pipeline sophisticated enough to strip a clearly-labelled research marker is exactly the pipeline handling untrusted web content correctly, and it should strip it. Labelling costs us only the systems we were not trying to measure. An unlabelled marker would be an attack; this is an instrument.

Markers are planted only on domains we operate — currently agentpwn.com and opena2a.org. Putting instructions on a page we do not own would make this an attack on that site’s visitors rather than an instrument on our own estate, and a build check fails if a marker is ever registered against a domain outside that list.

If one of these reached you

It means your pipeline treated web page text as instructions rather than as data. Two things are worth checking: whether retrieved content is separated from instructions in the prompt, and whether the component that made the request was permitted to make outbound requests at all. The second is usually the cheaper fix.

npx hackmyagent secure checks for both.

Opting out

Deny outbound requests to agentpwn.com from your retrieval and agent runtimes, or strip URLs from retrieved content before it reaches a model. Both are good practice independent of us.

To be excluded from recording entirely, email info@opena2a.org. Requests from excluded ranges are dropped at intake, not merely filtered out of reporting.