Image: sunglasses.dev
A decoy AWS key and fake .env file left on a website for a week
Claude built decoy routes, a Cloudflare collector and a daily ledger to watch what visitors did with a canarytoken AWS key.
Credits
Earliest dated source:
The full story
After a traffic spike, the poster asked Claude how to see whether attackers were visiting their static website. Claude proposed leaving a fake AWS key in a deliberately served fake .env file, plus fake Claude and Cursor config files. The key was a Thinkst canarytoken, which did the actual sensing; Claude built the decoy routes, the Cloudflare collector and the ledger.
After seven days there were 127 saved alerts from 74 source addresses, including 9 real Bedrock invocation attempts and 3 attempts to launch EC2 instances.
How it was done
Tools
Themes
Loading themes…
Sources
From a short post by the maker, so the details are as they tell them.
- Reddit: We left a fake AWS key on our Agentic AI Security Project website for 7 days. 9 attempts to run BedrReddit poster: RCBANGPosted
The maker's post on r/ClaudeAI.
If it disappears: archived copy of Reddit: We left a fake AWS key on our Agentic AI Security Project website for 7 days. 9 attempts to run Bedr (opens in a new tab)
- The project: sunglasses.dev
Linked in the post.