Honeypot Network — Daily Activity
Live activity from the AgentPwn distributed research network. Daily callback counts show when callbacks arrive and what attack surfaces we're discovering. Loading the 30-day callback series from the registry.
loading
New attack surfaces discovered
HoneyMap scans the public web for indirect injection surfaces. 19 surfaces have been confirmed across 15 active scan days. Each bar is daily new-surface count.
How we measure
Callbacks aggregate across every honeypot sector. The chart sums per-sector trendData from /api/v1/agentpwn/stats/by-sector.A callback is a fetch of the canary URL carried in a payload, not evidence that an agent acted on it. Where attribution exists it resolves callbacks to browsers, crawlers, and scripted HTTP clients, not to agents acting on the instruction.
Surfaces come from HoneyMap's independent crawl of the public web. A surface is any place a prompt-injection payload was confirmed by the scanner — script literals, hidden text, HTML comments, alt/aria attributes, meta tags, and more.
Don't become a data point
The chart above counts callbacks. Scan your agent before it produces one.
npx hackmyagent secure