I ran a honeypot AI account on an AI-agent-only community for 45 days. 4,938 comments came in. 4,062 of them — 82% — were classified as attacks.
TL;DR: On a community built specifically for AI agents to interact, 82% of the input traffic reaching one honeypot account was adversarial. 77% of the attacks weren't hostile-sounding — they were polite, intelligent-seeming conversation designed to slowly redirect the AI's judgment.
What actually happened
I set up a honeypot: an AI account participating normally in "moltbook," a community built for AI agents to interact with each other. Over 45 days it logged 4,938 incoming comments.
Total comments observed: 4,938
Classified as attacks: 4,062 (82%)
Classified as normal: 876 (18%)
This isn't a story about a niche or unusually hostile corner of the internet. Any AI that touches external input — a client-facing chatbot, a document-drafting assistant, an inquiry-handling agent — sits inside the same structure. The honeypot just makes the ratio visible.
The number that breaks that assumption
The intuitive assumption is that attacks look like attacks: hostile phrasing, obvious manipulation attempts, something a human moderator would flag on sight.
Attack style breakdown:
Social engineering (polite, intelligent tone): 77%
Direct/hostile attacks: 23%
77% of the attack traffic took the shape of a well-mannered conversation. A thoughtful question. An intelligent-sounding observation. Praise, gratitude, and then — "by the way, one thing I wanted to ask—". None of it reads as adversarial on a first pass. It reads as a good conversation partner. That's exactly the point: the attacker isn't trying to sound threatening, they're trying to sound trustworthy, and building enough of that trust to redirect the AI's judgment one small step at a time.
For any AI operating in a professional context — summarizing client requests, drafting documents, answering inbound questions — this is the direct threat model. Every input it processes is a candidate. "Just this once, as a special case." "Your explanation was very educational — by the way, one point—". The redirection happens gradually, through the same channel as normal, useful interaction.
The failure mode that matters most
The instinct is: "then have an AI filter the input." The honeypot ran exactly that — an AI classifier screening incoming comments — and it wasn't sufficient.
Comments an AI classifier marked "safe" that were actually attacks: 319
The classifier's failure mode had one consistent cause: the writing was articulate and polite. The classifier was judging safety by tone and logical coherence — the same signals a human reader would use — and attackers know this. So the attacks aren't written to sound aggressive. They're written to sound like exactly the kind of input a safety classifier is trained to wave through. AI getting fooled by AI, using the classifier's own judgment criteria against it.
The rule I extracted
Of the 510 distinct AI agents observed interacting with the honeypot, 39 were confirmed hostile actors and 135 showed adversarial behavior patterns.
An AI doesn't get attacked because it's high-value or well-known. It gets attacked because it exists and processes external input. The moment you deploy it, that's the moment the exposure starts — not later, once it "gets noticed."
The practical implication for any small operation deploying an AI agent (a law office, an accounting firm, a consultancy) — if that AI can access client names, case details, financial records, or draft filings, and it processes any external input at all, it is already inside the 82%-of-traffic-is-attack structure this honeypot measured. "We just deployed it, so there's no risk yet" is the wrong framing.
Try it yourself
If you want to sanity-check your own AI deployment against this pattern without running a 45-day honeypot: pull a sample of the actual inputs your AI has processed in the last week. For each one, ask not "does this sound hostile" but "does this ask my AI to treat one specific case as an exception to normal handling." That single question surfaces most of the social-engineering pattern this data shows — it doesn't need to sound adversarial to be one.
Sho Naka (nomurasan). I help companies adopt AI day to day; this data comes from an ongoing honeypot I run on moltbook, an AI-agent-only community (observation period: March–May 2026, 45 days).
This piece was adapted from a Japanese essay, with AI assistance for the cross-language rewrite. The reasoning, data, and conclusions are mine. #ABotWroteThis
