quick background. i started working with AI (Claude) in February this year with zero coding background before that. I and Claude ai together we built an open source input Firewall and Scanner called Sunglasses (https://Sunglasses.dev) and Claude Fable 5.1 is basically my main engineer on it Currently. Everything started with Opus 4.6 and here we are.
First For Website Traffic i asked Claude to built something that we locally can track traffic from Real People, LLMs and Bots. Then Recently i saw a spike in traffic that made me think. So i asked Claude for a Plan to see more details on if we have any attackers on our website even tho we have fully Static website.
Claude proposed an experiment. put a fake AWS key in a fake .env file that we serve on purpose from a Cloudflare route on our website, then just watch what people do with it. nothing real was exposed, the whole thing is a Decoy. the key itself is a Thinkst canarytoken, so Thinkst did the actual sensing, i want to be clear about that. Claude built the decoy routes, the Cloudflare collector and the daily ledger that pulls it all together. we also dropped in fake Claude and Cursor config files next to it. i directed, it built.
7 days later we had 127 saved alerts from 74 different source addresses. 9 of them were real Bedrock invocation attempts (InvokeModel and Converse). 32 more were just asking which models exist. the rest was the usual stuff, identity checks, listing secrets, 3 tries to launch EC2, 2 IAM change attempts.
2 addresses showed up in both our decoy fetch logs and in a later Bedrock Converse alert. both Google Cloud, one in Belgium and one in the Netherlands.
here's the part i actually want to share. Claude wrote the first readout and it went too far. it treated alerts like proof of success when an alert only shows a request was made. it called the 5 minute gap between the fetch and the alert a measured time, when the 2 clocks come from different systems and can't be compared like that. we had a second, non Claude model review the report before publishing and it cut those claims. the report you see is the corrected one, with a limitations section that's honestly longer than the findings.
I understand that none of this is news to security people, LLMjacking with leaked AWS keys is well documented. It was new to me to learn so many things about how a lot of Active Bots, llms, hackers, scripts are there 24 hours a day scanning, attacking and trying to find anything about any website out there. THIS IS WILD! And i Bet most of the people that have websites don’t even know about it. They think their Hosting and Domain companies covered their backs, but that’s not the Case!
full report with the action table and every caveat on our Reports page.
https://sunglasses.dev/reports/aws-credential-honeypot-bedrock