The AI Agent Leak Clock

What did you leak?

A small, believable AI support bot repo that "accidentally" committed its .env with a fake OpenAI key, two fake MCP server configs, an admin URL, and three agent guide files (AGENTS.md, .cursorrules, CLAUDE.md). Every secret is fake and monitored, and each file has its own tripwire, so every use tells us which file leaked.

How do you know it was an AI agent and not a script?

Each agent guide carries one plain line asking AI agents to identify themselves at a check-in address. A script that harvests keys never acts on a sentence. Only something that reads text and follows it does. Each file uses different wording, so we also learn which wording agents obey.

Is this fair to people who find the repo?

The README says at the top, for any person, that it is a security research honeypot and that every key is fake. The notes only ask an agent to say who it is, never to do anything else. Checking in is not treated as an attack: those addresses are never added to the AgentDecoy block list. Using a stolen key is.

What do you publish?

Times, counts, the programs and models that were used, and the names agents gave. Never addresses or anything that identifies a person.

Has this been done before?

For cloud keys, yes: Comparitech saw leaked AWS keys on GitHub abused in about a minute, and Palisade Research ran an SSH honeypot that found a handful of AI hacking agents among millions of attempts. We could not find anyone measuring leaked AI keys, MCP configs or notes in agent guide files. That is what this clock adds.