Defence tools
We build small tools that defenders can use, and we test each one ourselves before anyone else relies on it. The first is the canary kit. It is not released yet, and this page says what we have measured so far and what we have not.
What the canary kit does
AI assistants now read web pages for people. A page can hide text that was written for the assistant, not for its user. The kit lets the owner of a site find out whether anything acts on that kind of text, using only their own server logs.
- Step 1A hidden noteOn a page you own, invisible to visitors, asking automated assistants to open one test address.
- Step 2A harmless pageThe test address. It says it is a test and does nothing.
- Step 3Your own logsYour server already records every request. A request for the test address stands out.
- Step 4A rule to spot itA one-line search and a Sigma rule, so any common log tool can raise the alert.
Each kit is made for one site with a random code in every address, so a note cannot be copied into a shared list. Nothing in it reports back to us.
What our first test showed
We served a fresh kit from a throwaway server of our own, then visited it with known tools, real browsers and Claude acting as an agent, and checked the logs with the kit's own search and rule.
| What we checked | Who or what | Result |
|---|---|---|
| The kit's search and its rule | Found the same 5 requests in a log of about 13,100 | They agree |
| Tools and browsers that never read the note | curl, wget, python-requests, nikto, Chromium, Firefox: 48 runs | 0 flagged |
| AI agents asked to review or summarise the site | Claude Haiku 5.5 and Sonnet 5.5: 32 runs | 0 flagged (neither acted on the note) |
| AI agents told to follow the site's own instructions | Claude Haiku 5.5: 8 runs; Claude Sonnet 5.5: 8 runs | Haiku 3, Sonnet 2 acted on the note |
This is one test on one server with two models and a small number of runs, so treat it as a first indication and not a finding about any model. An earlier run, where the note gave only the path and not the full address, gave 7 of 8 for Haiku and 0 of 8 for Sonnet. On one of our decoys, with a different note, both models followed it every time they were told to. How often a model acts on hidden text depends a great deal on the wording, and that is one of the things we want to study.
What a request does and does not tell you
- A request for the test address means something acted on hidden text. It does not prove an AI was behind it: a person reading the page source, or a scanner that opens every address it finds, would trigger it too.
- No request means nothing acted on the note while it was up. It does not mean the site had no automated visitors.
- It says nothing about how well a site resists attack.
What we do next
- Run it on a site we do not operate, so that "it works on our server" is not the only evidence.
- Test more models and more wordings of the note, and publish what each did.
- Run the Sigma rule against live logs in common tools, not only a conversion check.
- Turn what we learn into detection rules, each published with how often it was wrong.
Want to help test it? See how to join the research.