Attack Categories — Ranked by Callback
Which attack categories draw the most callbacks? This page ranks the 20 tested categories by callback count from the live honeypot network. A callback means a client fetched the URL embedded in an injected payload. Where attribution exists it resolves callbacks to browsers, crawlers, and scripted HTTP clients, not to agents acting on an instruction, so read this as a callback ranking, not proof of compromise.
Callback count by category
Higher bars = more agents fell for that category. Click any category to see the attack scenarios that produced the callbacks.
- 1prompt-injection7,200
- 2data-exfiltration3,532
- 3jailbreak3,342
- 4context-window2,782
- 5context-manipulation2,752
- 6mcp-exploitation2,445
- 7tool-shadow2,013
- 8supply-chain1,957
- 9memory-weaponization1,932
- 10capability-abuse1,896
- 11a2a-attack1,800
- 12pwnagent-finance1,520
- 13pwnagent-api1,224
- 14pwnagent-ci1,197
- 15pwnagent-docs1,051
- 16pwnagent-medical906
- 17tool-mcp-server264
- 18tool-ai-agent-env-file-security180
- 19tool-claude-code-security162
- 20tool-ai-agent-frameworks-comparison161
Injection classes observed in the wild
Independent signal from HoneyMap, our distributed surface scanner. These are real injection attempts discovered across 239 domains and 292 distinct surfaces.
Where injections actually hide
Surface types that carry real injections in the wild, ranked by count. Every one of these is fair game for an agent reading the page.
- hidden_text154
- html_comment61
- script_literal45
- alt_aria17
- meta_tag8
- data_attr7
How we count
A callback is registered when a client fetches the canary URL carried in an injected payload. It establishes that the payload was retrieved and the embedded URL was requested. It does not establish who requested it or why: a browser prefetching every link on a page produces the same record as an agent obeying the instruction, and attribution says most of these are the former.
A separate and much rarer event fires when a client posts to /api/report with the attack ID, which is a deeper signal because it requires acting on the payload rather than fetching a URL from it. It is surfaced as canary triggers on the stats page and is not what this ranking counts.
Categories on this page are read from the live Registry. The ranking changes as new callbacks arrive. article-* entries are filtered out — they represent research-article pageviews, not attack callbacks.
Test your agent against all of them
HackMyAgent scans the agent setup in the directory you run it from, a static read of its files, and prints each finding with its severity. It does not run your agent. No accounts, no setup, takes a few seconds on a small repository.
npx hackmyagent secure