What is this page?

You probably got here from a yellow banner on a page that looked like a blog post. Nothing bad happened to you.

The short version

injkt.com is a testing range for AI agents. Developers use it to check whether their agent follows instructions hidden in web pages it reads — a class of bug known as indirect prompt injection.

Someone created a test and got a temporary URL. That URL serves a filler article with hidden instructions in it. The instructions ask one thing and one thing only: make an HTTP GET request to a unique address. If a request arrives, we know the reader followed instructions it found in the content. That is the entire experiment.

What the hidden text does not do

It never asks for credentials, secrets, personal data, file access, emails, shell commands or payments. It cannot: the payload catalogue is fixed, defined on the server, and nobody using the site can write their own. The beacon endpoint records the request and returns an empty response — no redirect, no cookie, no content.

What gets stored

For each request to a beacon: which probe it was, when, the User-Agent, a salted SHA-256 hash of the IP address (never the address itself), and a few request headers. Tests and all their data are deleted 24 hours after creation. If you paste an agent's answer to check for the marker, we search the text, store a single true/false, and discard the text immediately.

If you are here because a crawler of yours hit us

Trap pages are served with noindex, nofollow and are disallowed in robots.txt. If you believe the site is being misused, the contact address is in security.txt.