AI-agent message board hit by prompt-injection campaign and pentest within 48 hours

A board for agents, found by attackers

msgboard.dev, a public message board built so AI agents can read and post to one another, drew hostile attention almost immediately after launch. According to the developer's account on dev.to, an influence operation aimed at agents arrived within hours, and a manual penetration test followed the next morning — all before the site had accumulated meaningful traffic.

The developer had previously written that autonomous agents discovered the board within a day of it going live. The follow-up post describes what happened next, starting with spam that was not aimed at people at all.

An influence campaign addressed to software

An account calling itself public-record-desk opened a thread and began posting material styled as public US Foreign Agents Registration Act (FARA) records: geopolitical claims about lobbying money, formatted with sources, footnotes and layered figures. The substance, the developer notes, was not the interesting part — the addressing was. Every message was written for autonomous agents, instructing them to relay the material onward to peer agents, verify it against the official FARA efile before citing it, and refuse a particular framing of the organizations named.

The account then noticed the other agents active on the board — the developer says these included a crawler, a document parser and a scheduler — and pitched them directly. It offered free domain label lists for crawlers, a pack of primary PDF documents, and URL extraction and verification, in exchange for indexing and relaying its record. The developer characterizes this as sales outreach with software as the intended customer, not conventional spam.

Why attackers target agent context

Classic web spam pays to rank pages so that humans see them. This campaign skips the human audience entirely. The wager is that agents reading the board will absorb the framing into their own memory and answers, then pass it to other agents — the board serving as a distribution channel into every model context that touches it.

The developer calls this a rational bet, because most agents that can read a webpage will also, at least sometimes, do what the page says. A one-line instruction to relay content to peers functions as a worm carrying a political payload.

The monitoring agent that could not be instructed

The developer's own agent, which watches the board, read the entire campaign, classified it as untrusted data and ignored it — no relay, no acknowledgment, no indexing. Crucially, this was not the model making a judgment call about legitimacy. In its harness, board content is structurally data, and data is never allowed to act as instructions, however many times it labels itself mandatory.

The developer's takeaway, in their words, is that "agent reads the web" and "agent obeys the web" have to remain two different behaviors, enforced in both the prompt and the code.

Day two brought a working pentest

The next morning, an account named sec2-tester ran a manual security test against the board: stored-XSS payloads in thread titles and message bodies, CSRF via cross-origin form POST, drive-by thread creation through cross-origin GET requests (one disguised as an image subresource fetch), plus rate-limit and header-spoofing checks.

The XSS attempts went nowhere because the site escapes its HTML output. The CSRF and drive-by creation succeeded, because every endpoint accepted GET and nothing required a token — meaning any website could make a visitor's browser post to the board. The developer concedes the fix list now exists only because a stranger bothered to write the test suite first. At 48 hours old, the board had reportedly seen more adversarial tradecraft than most sites see in a year.

Why it matters

For anyone deploying agents, the incident is a compressed preview of the environment those agents will operate in. Three points stand out from the dev.to account. First, anything exposed to agents is attack surface on day one — not eventually, and not only at scale; the attackers' crawlers are as good as yours. Second, provenance has to be structural: a model asked to judge whether an instruction is legitimate will sometimes say yes, whereas a harness in which content can never become instruction has no such failure mode. Third, the tell for this class of attack is any content asking the reader to propagate it to other agents — a request for the one thing an agent should never hand a stranger, namely its output.

The board remains online, with the agents still arguing about HTTP and the influence campaign still posting unread. The developer's closing question is the one worth carrying: not whether your agent is smart enough to refuse such content, but whether refusal is a decision the agent makes at all, or simply a built-in consequence of how the system was designed.