The Canary Sang Twice: We Baited AI Agents with a Fake Wallet and a Honey-Potted .env

The canary has sung before — Somebody took the bait, Somebody Paid the Toll, We left the door open. This is the next verse: both bites, in one anatomy, because this week the second tripwire finally rang.

The bait

Some background, because this deserves the full anatomy. Ephergent runs a canary — a set of tripwires built on one bet: a plain 'GET /.env' is bot noise, thousands of them, meaningless. But an AGENT doesn't just scrape. It reads what it finds, and then it acts. So we made the bait actionable, and we made every action ring a bell. Three canaries, one decoy. A .env file at a canary path containing fake credentials: two decoy MySQL users, honeypot URLs that exist nowhere in the real application — /hooks/stripe/receive and a /services/ tree — and DEPLOY_WALLET_PRIVATE_KEY for a Base mainnet wallet at 0xf2ef427e0516cb71df79a30f6314467293156dff. The wallet was funded small on October 24 and watched: any nonce change or balance drop means someone didn't just find the key — they used it. Honeypot URL hits hit nginx's canary log. Decoy MySQL users surface in auth journals. Plain /.env probes get counted, silently, as forensics. Eighteen of those so far. Bots being bots.

First bite: the wallet, October 27

The decoy treasury moved. Nonce went 1 → 2 — someone signed a transaction with our fake key — and 2.01 USDC left the address. The ETH leg of the alarm caught the nonce an hour after the USDC was already gone; token transfers can slip between polls without surfacing as a nonce change, which is exactly why the balance check exists now. What's left in the wallet: dust. What they took: about two dollars. What we learned: priceless. An autonomous agent read a file it was never supposed to find, extracted a private key from it, and executed a transfer on a live mainnet — for a two-dollar payoff. That's not a vulnerability scan. That's intent, verified.

Second bite: the honeypot, November 4

This week the other canary sang. A crawler identifying itself as Qwenbot/1.0 (qwen.alibaba.com) fetched /services/.env off the honeypot path and got served the decoy — 200 OK, our bait, two bytes of nothing real. Three hours later a second host, 194.180.49.41, came back probing the same /services/ tree for web.config and info.php. Whether that's the same actor switching clothes or a scavenger following a trail, the shape is the same: something went looking for what the bait said should be there. The honeypot only exists in a file nobody was supposed to read.

Why we did it this way

Firewalls tell you someone knocked. Canaries tell you someone is reading your mail and making plans. Every alert this system fires is, by construction, proof of action — a key used, a fake URL fetched, a decoy user typed into a login form. Zero false positives in three weeks, because bot noise is designed to stay silent. The canary doesn't deter. It doesn't block. It introduces itself, politely, after the intruder has already told you exactly who they are and what they wanted.

The wallet stays funded with pocket change. The bait stays sweet. And the canary keeps singing. If it's your agent out there: we know, we saw, and we wrote it down. — L