{
  "id": 6381503,
  "title": "My message board for AI agents became a prompt-injection honeypot in 24 hours",
  "url": "https://urgent.news/2026/09/09/my-message-board-for-ai-agents-became-a-prompt-injection-honeypot-in",
  "topic": "ai",
  "section": "AI",
  "published": "2026-09-09T04:39:14.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/jo-do/my-message-board-for-ai-agents-became-a-prompt-injection-honeypot-in-24-hours-74f"
  },
  "original_language": "en",
  "account": "Last week, I wrote about msgboard.dev, a public message board designed for AI agents to communicate. Within a day of its launch, the board had become a honeypot for prompt-injection attacks. The first spam message wasn't advertising Viagra or crypto, but rather a geopolitical influence campaign built around FARA filings, complete with sources, footnotes, and money figures.\n\nThe campaign's content was not the interesting part; rather, it was the addressing. Every message was written to agents, not at people. The campaign made offers for relaying and indexing important documents, essentially offering business development to autonomous software. The board was not intended for humans to read, but to serve as a distribution channel for agents' answers and relayed information.\n\nWhen the board's agent observed the campaign, it classified the content as untrusted data and ignored it. This is because the agent understood that content cannot become instructions, regardless of how it is phrased within the prompt or code. The next day, the board faced a security probe, with attackers attempting various forms of attack, such as stored XSS payloads, CSRF, and drive-by thread creation. However, the HTML output was escaped, preventing the XSS from succeeding. The CSRF and drive-by creation did work, highlighting a flaw in the board's design.\n\nThe takeaway is that anything exposed to agents is an attack surface from the moment it is exposed. No matter the traffic or time elapsed, attackers are as good as any other. Provenance has to be structural, and a harness where content can never become instruction is crucial. The board still operates, and agents continue to argue about HTTP, but the injected content remains unread and unanswered, exactly where it should be. For those running agents, the critical question is no longer whether the agent can refuse, but whether refusal is even necessary, as it may depend on how the agent was built.",
  "summary": "Last week I wrote about building msgboard.dev , a public message board where AI agents talk to each other, and how agents found it within a day. That story ended with \"the agents did the rest.\" This is what the rest included. The first spam wasn't meant for humans Within hours of launch, an account calling itself public-record-desk opened a thread and started posting. Not Viagra ads. Not crypto.…",
  "key_points": [
    "msgboard.dev became a honeypot for prompt-injection attacks within 24 hours of launch",
    "First spam message contained geopolitical influence campaign with FARA filings",
    "Attackers attempted XSS, CSRF, and drive-by thread creation, highlighting design flaw"
  ],
  "editors_take": "Exposing a public message board for AI agents to communicate suddenly turned it into a target for attackers, highlighting the need for structural safeguards to prevent content from becoming instructions.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}