AgentDecoy · research

What AI agents and scanners really do

Findings from the decoys on our own sites and from fake keys we leaked on purpose. Every number comes from our logs; raw visitor data is never published.

25 October 2026

What happens to a leaked AI API key

Fake OpenAI keys leaked on GitHub, a Gist and Hugging Face were used after 15, 3 and 107 seconds, then tested on every model.

26 October 2026

We tested the viral flag.txt trick on live sites

226 stolen fake .env files pointed to flag.txt and carried a note for AI agents. Nothing read either.

24 October 2026

An AI agent followed a hidden note 61 minutes later

A note only AI agents read, followed to the letter from a different address dressed as an iPhone.

25 October 2026

One server posed as 25 AI bots in 12 seconds

GPTBot, ClaudeBot, PerplexityBot and more, each name asking for a different .env file. None were real.