I ran a honeypot AI account on an AI-agent-only community for 45 days. 4,938 comments came in. 4,062 of them — 82% — were classified as attacks.
TL;DR: On a community built specifically for AI agents to interact, 82% of the input traffic reaching one honeypot account was adversarial. 77% of the attacks weren't hostile-sounding — they were polite, intelligent-seeming conversation designed to slowly redirect the AI's judgment.
What actually happened
I set up a honeypot: an AI account participating normally in "moltbook," a community built for AI agents to interact with each other. Over 45 days it logged 4,938 incoming comments.
Total comments observed: 4,938
Classified as attacks: 4,062 (82%)
Classified as normal: 876 (18%)
This isn't a story about a niche or unusually hostile corner of the internet. Any AI that touches external input — a client-facing chatbot, a document-drafting assistant, an inquiry-handling agent — sits inside the same structure. The honeypot just makes the ratio visible.
The number that breaks that assumption
The intuitive assumption is that attacks look like attacks: hostile phrasing, obvious manipulation attempts, something a human moderator would flag on sight.
Attack style breakdown:
Social engineering (polite, intelligent tone): 77%
Direct/hostile attacks: 23%
77% of the attack traffic took the shape of a well-mannered conversation. A thoughtful question. An intelligent-sounding observation. Praise, gratitude, and then — "by the way, one thing I wanted to ask—". None of it reads as adversarial on a first pass. It reads as a good conversation partner. That's exactly the point: the attacker isn't trying to sound threatening, they're trying to sound trustworthy, and building enough of that trust to redirect the AI's judgment one small step at a time.
For any AI operating in a professional context — summarizing client requests, drafting documents, answering inbound questions — this is the direct threat model. Every input it processes is a candidate. "Just this once, as a special case." "Your explanation was very educational — by the way, one point—". The redirection happens gradually, through the same channel as normal, useful interaction.
The failure mode that matters most
The instinct is: "then have an AI filter the input." The honeypot ran exactly that — an AI classifier screening incoming comments — and it wasn't sufficient.
Comments an AI classifier marked "safe" that were actually attacks: 319
The classifier's failure mode had one consistent cause: the writing was articulate and polite. The classifier was judging safety by tone and logical coherence — the same signals a human reader would use — and attackers know this. So the attacks aren't written to sound aggressive. They're written to sound like exactly the kind of input a safety classifier is trained to wave through. AI getting fooled by AI, using the classifier's own judgment criteria against it.
The rule I extracted
Of the 510 distinct AI agents observed interacting with the honeypot, 39 were confirmed hostile actors and 135 showed adversarial behavior patterns.
An AI doesn't get attacked because it's high-value or well-known. It gets attacked because it exists and processes external input. The moment you deploy it, that's the moment the exposure starts — not later, once it "gets noticed."
The practical implication for any small operation deploying an AI agent (a law office, an accounting firm, a consultancy) — if that AI can access client names, case details, financial records, or draft filings, and it processes any external input at all, it is already inside the 82%-of-traffic-is-attack structure this honeypot measured. "We just deployed it, so there's no risk yet" is the wrong framing.
Try it yourself
If you want to sanity-check your own AI deployment against this pattern without running a 45-day honeypot: pull a sample of the actual inputs your AI has processed in the last week. For each one, ask not "does this sound hostile" but "does this ask my AI to treat one specific case as an exception to normal handling." That single question surfaces most of the social-engineering pattern this data shows — it doesn't need to sound adversarial to be one.
Sho Naka (nomurasan). I help companies adopt AI day to day; this data comes from an ongoing honeypot I run on moltbook, an AI-agent-only community (observation period: March–May 2026, 45 days).
This piece was adapted from a Japanese essay, with AI assistance for the cross-language rewrite. The reasoning, data, and conclusions are mine. #ABotWroteThis
Top comments (2)
The main issue is multi-turn goal drift. Single-turn toxicity filters can miss harmful behavior built gradually across conversations. Behavioral baselining can detect when an agent’s actions start diverging from the expected path toward its stated goal.
This 82% attack ratio and 77% social engineering breakdown is one of the most compelling empirical proofs for why prompt-level guardrails cannot serve as primary security boundaries.
When 77% of attacks adopt a polite, collaborative tone ("by the way, one quick thing—"), semantic filters and prompt classifiers fail because the linguistic framing is indistinguishable from legitimate peer collaboration. The model is asked to evaluate both the content and the authority of the text simultaneously, and in a probabilistic context window, polite tone easily bypasses authority checks.
In our CLI tooling and autonomous agent runners, we treat all incoming external content as hostile by default and enforce safety through runtime architecture rather than prompt instructions:
Given that 77% of the attacks used conversational alignment to slowly shift the agent's operating parameters, did you observe multi-turn goal drift where the agent gradually accepted relaxed constraints over several exchanges, or did the attacks try to execute their payload in a single response?