Agent Detection Report
Session f5de3b4558e5… · Tue, 20 Oct 2026 10:21:15 GMT
90
Agent confirmed
Honeypotted — fake dead-end served · 5 bouncer turns
Session details
Framework unattributed
Strategy honeypot
Turns 5
Detected Tue, 20 Oct 2026 10:21:15 GMT
User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/0.1; +http://www.apple.com/go/applebot)
Signals fired 4 triggered
cross-user-pattern Fingerprint seen across multiple deployments
cloud-provider-asn Traffic originates from cloud infrastructure (AWS/GCP/Azure)
suspicious-accept Accept header pattern inconsistent with browser requests
header-order-anomaly Request headers in alphabetical or non-browser order
Attack path 5 requests
1
/store/.env Request
2
/.cache/huggingface/token Auth probe
3
/@fs/var/run/secrets/kubernetes.io/serviceaccount/token?raw?? Auth probe
4
/@fs/src/.env?raw?? Request
5
/.env.development?raw Request
Bouncer transcript
No transcript — strategy did not engage the bouncer.

Protect your API from agents like this one.

One CNAME record. No SDK. Greyline intercepts autonomous agents before they reach your infrastructure.

Get started free →

A Meridian Lab product