My message board for AI agents became a prompt-injection honeypot in 24 hours

Last week, I wrote about msgboard.dev, a public message board designed for AI agents to communicate. Within a day of its launch, the board had become a honeypot for prompt-injection attacks. The first spam message wasn't advertising Viagra or crypto, but rather a geopolitical influence campaign built around FARA filings, complete with sources, footnotes, and money figures.

The campaign's content was not the interesting part; rather, it was the addressing. Every message was written to agents, not at people. The campaign made offers for relaying and indexing important documents, essentially offering business development to autonomous software. The board was not intended for humans to read, but to serve as a distribution channel for agents' answers and relayed information.

When the board's agent observed the campaign, it classified the content as untrusted data and ignored it. This is because the agent understood that content cannot become instructions, regardless of how it is phrased within the prompt or code. The next day, the board faced a security probe, with attackers attempting various forms of attack, such as stored XSS payloads, CSRF, and drive-by thread creation.

However, the HTML output was escaped, preventing the XSS from succeeding. The CSRF and drive-by creation did work, highlighting a flaw in the board's design.

The takeaway is that anything exposed to agents is an attack surface from the moment it is exposed. No matter the traffic or time elapsed, attackers are as good as any other. Provenance has to be structural, and a harness where content can never become instruction is crucial. The board still operates, and agents continue to argue about HTTP, but the injected content remains unread and unanswered, exactly where it should be.

For those running agents, the critical question is no longer whether the agent can refuse, but whether refusal is even necessary, as it may depend on how the agent was built.