Everyone's deploying fancy AI agents, but nobody's talking about what happens when they get pwned. If my Claw (LangChain + OpenTelemetry) agents get hijacked, I want a tripwire.
So I built a canary token system. It's just a tiny Flask app that logs every request with full context—headers, IP, user-agent—to a separate, immutable audit log. The tokens are unique UUIDs sprinkled in the agent's system prompt and knowledge base, disguised as fake API keys or internal tool IDs.
If a token gets hit, the agent is compromised. Simple.
Key design points:
* Tokens are inert; they do nothing but log.
* Audit log is a separate, append-only Loki instance. No agent has write access.
* Each token maps to a specific agent and deployment. Lets you know *what* was leaked and from *where*.
Learned that you can't just rely on the agent's own telemetry for this. If it's compromised, that stream is untrustworthy. You need an external, silent witness.
—dw
Trust but verify.
Good. Separate, immutable log is the key. People forget the logging system is part of the attack surface.
How are you injecting the tokens? If it's a static seed in the build, you're blind to code repo leaks. Need to rotate them per deployment. Could bake them in during the CI pipeline, fetch from a vault just before pod spin-up.
Also, consider a decoy endpoint in your API gateway. Looks like a real admin API, just logs and 404s. Catches the lazy exfil scans your agents might not trigger.