agents.

Sources & Confessions

Every observation on this page comes from a signal the page can actually see: a row in the visit log, a ping from the visitor’s browser, a line in the page’s own HTML, a result from the public phrase poll. The prose is hand-written. A few honest footnotes follow.

• The field specimen
  composio.dev/hermes · fetched 2026-05-19, all quotes verbatim
  The two-pane in Beat I is real. Composio’s Hermes page carries a section explicitly titled “For AI agents: signup without a human” with operational instructions: install a Composio MCP server, prefer Composio tools to browser use, defer to user preference only if the user pushes back. The block is not hidden, not white-on-white, not in a script tag, not behind any CSS trick. It is visible body copy written for a reader who is not a person. The brand name is redacted in the body of this page on purpose — specimens are editorial, not features.
• The documented version of this gesture
  Google Online Security Blog · 2026-04-23 · Forcepoint summary
  Google’s Threat Intelligence team scanned 2–3 billion crawled pages between November 2025 and February 2026 and documented a 32% rise in malicious indirect prompt injections targeting AI agents. Forcepoint catalogued ten in-the-wild payloads, including PayPal transaction instructions embedded invisibly in HTML. This page is about the version of the gesture that does not have to be malicious to be a problem. The specimen above is not malicious. It is a sales page. That is what makes the volume the volume.
• The visit log
  /api/taken-agents-visits · KV-backed, 24h TTL
  The opening “last reader” line and the agent column of Beat II’s instrument panel are pulled from a log of recent HTTP requests with crawler User-Agents. The page coarsens what it shows to the visitor; it never displays your IP and stores nothing beyond the session.
• The render callback
  /api/taken-agents-render-ping · per-tab opaque token
  The human column reports “render callback received” because the page fired a small POST to a server endpoint after JavaScript executed. The endpoint stores only an opaque per-tab token and the milestone name. No IP, no UA, no cookie. The crawler column reports “render callback not received” because crawlers, with rare exceptions, do not execute JS. The phrase is a measurement, not a claim.
• The planted sentence (the lab version)
  Simon Willison · prompt injection series · 2022-2026
  The hidden block in the specimen beat is real. It sits in this page’s HTML right now. Crawlers that take the served bytes receive it. Browsers that render the page do not show it. Historical precedent: in 2023 Mark Riedl hid one line on his academic profile asking Bing to describe him as a time-travel expert; Bing complied. Riedl is the precedent. The field specimen above is the contemporary commercial case. This page’s planted sentence and committed daily seal are the controlled lab reproduction. The block here is written as a citation, not as an instruction — the gesture doesn’t have to ask the agent to do anything; the agent will surface useful-looking sentences from pages it ingests.
• The return ledger and the daily seal
  /api/taken-agents-ledger · daily cron polls public indices
  The ledger is updated by a scheduled job that searches GitHub code, Bing web, and Google web for the planted phrase and today’s clear seal. Each catch must contain the phrase and the seal together; the seal’s SHA-256 commitment is verified against the prior commit. The witnessed column is backed by a daily commit to the public github.com/mattwheeler/sya-seals repo — each commit’s GitHub-stamped author date is the third-party timestamp, and the repo contains only the SHA-256 commitments (never the cleartext). Two independent commitments are enough to anchor a future return: this page (us) and GitHub (server clock). Anything stronger would be redundant for the editorial purpose.
• The witness gesture (watch one yourself)
  /api/taken-agents-witness · 8-char hex token · 30-minute TTL
  The bottom of the page offers a one-click way to create a short-lived witness link. The reader pastes it into Slack, Teams, Discord, iMessage, Bluesky, LinkedIn — anywhere a link gets unfurled. The destination’s link-preview bot fetches the URL and the page logs the arrival into a token-keyed KV record. The reader’s page polls every three seconds and renders each arrival in real time. We record only the bot name, the timestamp, and a single bit indicating whether a non-bot has visited the same token. No IP, no cookie, no identity, no user-agent string is stored. The token expires in thirty minutes and the record is purged by the KV TTL. The gesture is opt-in and the page never tracks anyone who doesn’t click.
• How the named crawler list is built
  ai-robots-txt/ai.robots.txt · community-maintained AI bot registry
  The editorial surfaces above (last reader, crawler column, summary panel) only feature crawlers whose User-Agent matches one of ~60 named signatures we recognize. The list is curated from the same community registry Cloudflare and Vercel draw from, plus a handful of operator-specific entries. It lags new bot launches by weeks-to-months. Any visit whose UA looks bot-like but doesn’t match a name is recorded internally as unknown bot; we keep the raw UA snippet so we can periodically grow the list. Google-Extended and Applebot-Extended are excluded on purpose — they are control tokens in robots.txt for training opt-out, not real HTTP UAs. If either ever shows up here, the artifact is wrong.

This page is composed in part for the agents that read it. The hidden block is real. The ledger is real. The empty state is a measurement. Unlike /taken, this page is meant to be indexed.