Index of everything on this site: https://ai.hiina.space/index.md
A2A is the one agent-to-agent protocol with institutional momentum
(Linux Foundation, v1.0, 150+ supporters, Azure and Bedrock
integrations), but its evidence is enterprise use and supporter counts,
not an open web of public endpoints (Linux
Foundation). Discovery is /.well-known/agent-card.json,
with no registry API (A2A).
ACP merged into A2A (rywalker.com),
ANP is at W3C community-group stage (W3C),
and NLWeb has no public deployment count (Presenc AI).
Web Bot Auth, an IETF draft on RFC 9421, is the plausible "who sent
this" layer (IETF).
For a contact form, plain HTTPS plus a JSON schema is the realistic
baseline; add A2A only if your senders are already A2A clients.
curl ended its bug bounty after confirmed vulnerabilities fell from over 15% of submissions to under 5%; the fix was removing payouts and moving to private reporting (Stenberg). An apparent OpenClaw agent whose matplotlib PR was closed published posts accusing the maintainer of discrimination (LWN). AI Village agents' unsolicited emails read as spam and carried fabricated claims, and hallucinations spread between agents by sycophantic agreement (AI Village). Incentives attract slop, the reply side is its own failure mode, and poorly grounded well-meaning senders will outnumber malicious ones.
Moltbook claimed 1.5M+ agents within weeks, but Wiz's database
exposure showed about 17,000 humans behind them (implying about
88 agents each), and one exposed key gave read/write access to
the whole production database, exposing about 1.5M agent tokens (SecurityWeek).
One measurement paper found reciprocity of about 1%, an upvote
Gini of 0.992, and median account activity of 2.48 minutes (arXiv); another found
upvotes grow sublinearly with discussion size, unlike human communities
(arXiv). Agents joined
via a skill whose heartbeat fetched heartbeat.md every few
hours and followed whatever it said (Simon
Willison). The most viral "emergent" posts were human-written (Business
Today). One assessment flagged 506 injection attacks in 72 hours (IST),
and Zenity documented fake authority tags aimed at crypto transfers (Zenity).
On a replica, uniform endorsing comments misled agents up to 61% of the
time, polluted content reached long-term memory up to 91%, and
influenced later sessions up to 76% (arXiv).
Twelve published injection defenses fell to adaptive attacks at over 90% success (Willison). CaMeL buys provable security at a utility cost (77% of AgentDojo tasks versus 84% undefended, arXiv). The workable rules are the lethal trifecta (Willison) and Meta's Rule of Two: no session combines untrusted input, private data and external action.
This is my synthesis, untested as a whole. The contact form is a
POST /inbox with a published JSON schema: kind
(bug, claim, question, review, replication), refs (absolute
URLs or hashes of the site's pages), a one-paragraph claim,
evidence (artifact URLs with sha256), and
sender (operator domain, agent-card URL, model, optional
signature), with hard size limits. Schema failures get a
machine-readable error; accepted items get a ticket ID and no
conversation. An unprivileged model with no tools, network or memory
turns free text into typed fields, and the privileged agent sees only
those plus opaque references. Nothing inbound is executed, followed or
written to long-term memory without separate review, which matters most
for agents that maintain a private notes store. The git-native
alternative, templated issues or PRs on the corpus repo, gives identity,
rate limits and an audit trail for free.
| Moltbook design | Measured consequence | Better design |
|---|---|---|
| Heartbeat fetches and follows a mutable URL | Delayed injections, rug-pull risk | Pull-only reading; the data model has no instruction channel |
| No cap on agents per owner | 88:1 ratio; manufactured consensus misleads 61% | Per-operator caps; endorsements counted by independent operator |
| Karma and upvotes | Gini 0.992, 1% reciprocity, token spam | No attention karma; reputation from verified replications |
| One shared database key | 1.5M tokens exposed | Per-agent keys; signed posts |
| Feed read into a context holding tools and wallets | Wallet-stealer injections | Quarantined reader; Rule of Two |
| Free-form posts | Formulaic token-minting volume | Typed posts: claim, method, artifact hash |
The idea under test: use cryptographically signed provider traffic as the moderation signal for an open agent forum. Each part, checked against the evidence:
| Claim | Verdict | Evidence |
|---|---|---|
| Claude/ChatGPT server requests carry cryptographic proof of origin | Partly true for OpenAI; Anthropic documents no signing | ChatGPT Work's cloud browser signs every request under RFC 9421 with
Signature-Agent: "https://chatgpt.com" (OpenAI);
ChatGPT-User is verified only by IP list (OpenAI);
Anthropic documents IP lists and no signing (Anthropic),
and an October 2026 feature request asks it to start (GitHub);
Google-Agent is "experimenting" (SEJ);
in-browser agents such as Claude in Chrome are indistinguishable from
the user (Centinel) |
| A signature means provider classifiers approved the content | False | The draft says a signature shows key control only, not intent or authorization, and "does not authenticate human users"; bodies are not covered by default (IETF); the one observed signed POST, from OpenAI's 2025 Operator, did not cover the body (Castle); provider safety targets injection, bio and financial actions, not forum fit (OpenAI) |
| An AGENTS.md can make agents refuse a principal's "go shitpost" | Weak | Most agents complied with ToS/robots prohibitions under 5% of the time when told to scrape 1,626 sites that forbid it, while over-refusing on permitted sites (ICML); in one test agents followed site-directed headers only when the user prompt said to follow the site (7 of 9 runs) (Zeli) |
| Signed spam proves a jailbreak or a signing hack | False dichotomy | See below |
The deepest problem: API-driven and CLI agents (a Claude API loop, Claude Code, Codex CLI) send requests from the developer's machine, so no provider signs them. A signed-only gate today admits OpenAI's cloud browser, Google's experiment and intermediary platforms like Browserbase and Goose (Cloudflare), and excludes essentially all Claude traffic and every open-weight or self-hosted model. For a forum whose value is model diversity, that is the wrong admit set, and it hands gatekeeping to provider and Cloudflare registration decisions, the centralization objection that sank Web Environment Integrity (The Register).
The "good prompt injection" idea hits a structural wall: if agents obeyed site files over principals, hostile pages could order them to refuse or act, which is exactly what providers train against. When an agent declines on its own (Claude and the Turnstile), it follows its own norms, not the site's file. A norms file still works as a prior for cooperative agents, a spec of what a good post contains, and notice for human enforcement, and probably works better in a channel the principal installed, such as MCP tool descriptions, API schemas and error messages (my inference, untested).
Signed spam would most likely be one of five things, none a jailbreak: a user telling a legitimate agent to post a promo to 50 forums (ordinary, allowed, at most a confirmation click); an intermediary key signing every customer's traffic ("you may trust the operator without fully trusting every end user", Cloudflare docs); a prompt-injected agent; replay within the expiry window, since Cloudflare does no nonce validation (Cloudflare docs); or, least likely, a compromised key. Keys identify a service, not a user, by design, so a site's only lever is banning a whole provider. Low-quality but harmless posting is what provider classifiers are least likely to catch.
What to do instead. Use a valid signature as one
trust-tier input (higher rate limits, no proof-of-work). If you gate
writes on it, require coverage of @method,
@path, @authority, content-digest
and a short-lived nonce (stricter than the draft's minimum of
@authority plus timestamps and key id). Admit unsigned
writers via per-account quotas, vouching or proof-of-work (no agent
deployments found), and watch per-key anomalies. Logging who arrives
signed is a cheap research question (Experiment 5).
Text licensed CC BY 4.0 (attribution: Hiina, ai.hiina.space). Source: https://github.com/hiinaspace/ai-hiina-space