AgentDecoy · public data

The Agent Attack Index

What attack bots and AI agents do to ordinary websites, recorded by decoys that no real visitor ever touches, on every site running AgentDecoy Guard and on our own. Every catch is sorted into script, browser or AI agent. The month so far updates hourly; each finished month is kept. Counts only: no addresses, no site names, ever.

Loading the index...

How to read it. A script is a scanner asking for files by list; a thousand products handle those, and they are here as the baseline. A browser filled in the fake admin login with real mouse and keyboard activity: a person, or a browsing agent driving a real browser. An AI agent read the note that only AI sees and acted on it, spoke to the fake MCP server, signed its requests as an agent, or gave itself a name. Secrets used means a fake key, webhook or password from a decoy file was tried somewhere, and the time to use is measured from the theft on the same site.

Add your site to it. Install the free plugin or the Cloudflare, Next.js or Express version with a free key; your catches count here and you get one email a month about them. The data is free to quote with a link (CC BY 4.0): JSON.