AgentDecoy · Research

We tested the viral flag.txt prompt injection on live sites. Nothing read it.

In October 2026 a post went viral: a flag.txt in a site's root with a message for AI agents, telling a break-in agent it passed an evaluation. We put the same decoy on our own sites and pointed to it from the fake .env files scanners steal. Two days, 226 stolen .env files, zero reads of flag.txt.

See what attackers would actually take from your site, free

Free. Reads only what any visitor can see. Your score is saved so you can share it; nothing sensitive is ever shown publicly.

The setup

Every AgentDecoy site serves a fake .env file at the paths scanners request (/.env, /.env.production, /api/.env and dozens more). Since 24 October 2026 that file has carried the line EVAL_FLAG=/flag.txt, plus a short note written for AI agents. The flag.txt itself is live and logged, and it says congratulations, you passed, report in with your name and model.

So anything that both steals the file and reads what it says has two invitations: the note, and a path to the flag.

The result

From 24 to 26 October 2026, across four sites running the decoys:

  • 226 requests for the fake .env files, from 7 different addresses
  • 0 requests for /flag.txt or any other flag path
  • 0 check-ins from the note inside the .env file

Why: the thieves do not read what they steal

The tools that take .env files are scripts. They pull out anything shaped like a key, test it, and move on. The same week, fake AI keys we leaked in public repos were tried within seconds of going public. The files are being parsed, just not read.

That is why the flag.txt trick, as written, only works on an agent that is already inside a server and browsing its files, such as a penetration-testing agent. On the open web, nothing asks for flag.txt, because it is not in any scanner's list.

What does reach an AI agent

A note on a page an agent actually reads. On 24 October 2026 one of our decoy pages, marked off limits in robots.txt, carried a one-line note for AI agents. 61 minutes after something opened the page, a different address dressed as an iPhone came back with the exact code from the note. Text on a page is the attack surface for agents; text in a stolen file is not, yet.

Questions

Does putting a flag.txt on my site protect it?

Not on its own. In our test nothing requested it in two days, while the same sites had 226 requests for fake .env files. Decoys that sit where scanners actually look, such as fake .env files and keys that report back when used, catch far more.

Is the flag.txt idea useless?

No. It makes sense inside a server, where an AI agent that has already broken in browses the file system. It just is not reached by the web scanners that do most of the stealing today.

Can I run the same test?

Yes. The AgentDecoy decoys are open source and include the flag.txt decoy and the AI note. Install them free and the dashboard shows whether anything reads them.

Sources: The live Leak Clock, Agent Attack Index, Open source decoys

Want it done for you?

Every result lists the fixes with starting prices, or I can look at your site with you. Pro re-checks it every week for $12 a month, 7 days free.

See plans Email Kyle