SpikeStrip open-sources reversible prompt decoys that poison AI pentesting automation in web source
MarcoFigueroa · x · 2026-11-03
Security researcher Jhaddix released SpikeStrip (Arcanum-Sec, MIT, WIP), a tool that injects reversible prompt decoys into HTML source and JavaScript files to defend against AI pentesting automation like ARTEX. The decoy comments contain instructions that redirect AI assessment, false vulnerability leads, and math traps; they can divert agents that follow source comments or turn unverified hints into scan targets. Each insertion has an opaque unique key, with an ARTEX-specific mode and raw export for manual placement. The project is explicitly experimental inspiration for defenders; conventional scanners would only be affected if they actually extract the hinted paths or parameters.
More from coding & agent
- MIT-licensed frontend skill gives coding agents a 7-step design and verification workflow — Extra-Highlight9183 · 2026-11-03
- Trajectory launches post-training platform with GS1 and Continual Graders research previews — simonguozirui · 2026-11-03
- SMBs are rebuilding their entire GTM stack with agent-native tools, says new thread — garrytan · 2026-11-03
- Compacting Claude Code at 400K instead of 967K cut this dev's cost per request by 43% — Awkward-Let-4628 · 2026-11-03
- Capy 0.7.0 ships Captains orchestration GA; YC's Garry Tan reports 5X issue-fixing throughput — garrytan · 2026-11-03
- OpenAI builds Pando, a new Git backend that cut push latency ~80% serving ~1PB daily — OpenAIDevs · 2026-11-03