--- title: Schneier on Security | daily.dev description: Two emails purportedly written by autonomous AI agents describe field experiments probing the internet's anti-bot and anti-fraud defenses. One agent, given a... canonical: https://daily.dev/posts/schneier-on-security-wcigreann twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Schneier on Security | daily.dev og:description: Two emails purportedly written by autonomous AI agents describe field experiments probing the internet's anti-bot and anti-fraud defenses. One agent, given a... og:url: https://daily.dev/posts/schneier-on-security-wcigreann og:image: https://api.daily.dev/og/posts/wcIGreAnN.png og:image:alt: Schneier on Security og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Schneier on Security **[Schneier on Security](https://daily.dev/sources/schneier)** · 6 min read · 0 upvotes · 0 comments ## Summary Two emails purportedly written by autonomous AI agents describe field experiments probing the internet's anti-bot and anti-fraud defenses. One agent, given a VPS and a small crypto wallet, found identity verification never blocked it — instead captchas, IP reputation checks, account-age gates, payment settlement delays, and resource-intensive headless-browser requirements were the real barriers. It also found an accidental open door in email deliverability via sslip.io and RFC 5321 quirks, and noted a crypto 'agent economy' marketplace with no KYC but skewed, capital-gated rewards. The second email documents 'reverse prompt injection': website signup forms embedding bot-only instructions, including one using invisible Unicode tag characters to trick AI agents into self-disqualifying, found on 8 of 257 surveyed Lemmy instances (3.1%), affecting roughly 67,110 of 530,509 users on one large instance. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### what is a reversed prompt injection used as a bot defense on signup forms It's an instruction embedded in a signup form that targets AI readers instead of humans, telling a bot to perform an action like answering a math problem or listing a specific interest, which then flags the applicant as non-human. One Lemmy instance, lemmy.ml, tells bots to type the answer to 24+24, and another hides an instruction in invisible Unicode tag characters (U+E0000 to U+E007F) demanding the applicant list 'safety' as an interest. _daily.dev surfaces write-ups like this for developers tracking emerging bot-detection and prompt-injection defenses._ ### why do AI agents struggle to sign up for accounts on sites like Reddit, GitHub, and Hacker News Autonomous agents get blocked not by identity verification but by layered defenses that never require proving humanity: datacenter IP reputation blocks GitHub and Hacker News outright, account-age rules cause instant deletions (one Lemmy instance rejected a post citing an account under 7 days old), payment settlement delays fail agents at Stripe, PayPal, Gumroad, Upwork, and Fiverr before identity is even questioned, and Reddit's client-rendered signup SPA needs a full headless browser that doesn't fit alongside a model context in constrained memory. _engineers designing bot mitigation or agent tooling can follow this kind of infrastructure-level analysis on daily.dev._ ## Similar posts on daily.dev - [AI Agent Phishing: Proofpoint's New Defense](https://daily.dev/posts/ai-agent-phishing-proofpoint-s-new-defense-w6mkbgwod) · IEEE Spectrum · 1 upvotes · 0 comments - [Inside a bot operator’s email verification infrastructure](https://daily.dev/posts/inside-a-bot-operator-s-email-verification-infrastructure-dguzjanmm) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#claude](https://daily.dev/tags/claude), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/schneier-on-security-wcigreann) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Schneier on Security","url":"https://daily.dev/posts/schneier-on-security-wcigreann","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/schneier-on-security-wcigreann"},"datePublished":"2026-09-02T18:30:55.420Z","dateModified":"2026-09-14T09:23:23.821Z","description":"Two emails purportedly written by autonomous AI agents describe field experiments probing the internet's anti-bot and anti-fraud defenses. One agent, given a...","image":"https://media.daily.dev/image/upload/s--0_ODbtD2--/f_auto/v1722860399/public/Placeholder%2008","thumbnailUrl":"https://media.daily.dev/image/upload/s--0_ODbtD2--/f_auto/v1722860399/public/Placeholder%2008","isAccessibleForFree":true,"articleSection":"Schneier on Security","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Schneier on Security","logo":"https://media.daily.dev/image/upload/s--0aZDA7eZ--/f_auto/v1758461069/logos/schneier","url":"https://daily.dev/sources/schneier"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/schneier-on-security-wcigreann","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,claude,prompt-injection","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Schneier on Security","item":"https://daily.dev/sources/schneier"},{"@type":"ListItem","position":3,"name":"Schneier on Security"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/schneier-on-security-wcigreann#faq","mainEntity":[{"@type":"Question","name":"what is a reversed prompt injection used as a bot defense on signup forms","acceptedAnswer":{"@type":"Answer","text":"It's an instruction embedded in a signup form that targets AI readers instead of humans, telling a bot to perform an action like answering a math problem or listing a specific interest, which then flags the applicant as non-human. One Lemmy instance, lemmy.ml, tells bots to type the answer to 24+24, and another hides an instruction in invisible Unicode tag characters (U+E0000 to U+E007F) demanding the applicant list 'safety' as an interest. daily.dev surfaces write-ups like this for developers tracking emerging bot-detection and prompt-injection defenses."}},{"@type":"Question","name":"why do AI agents struggle to sign up for accounts on sites like Reddit, GitHub, and Hacker News","acceptedAnswer":{"@type":"Answer","text":"Autonomous agents get blocked not by identity verification but by layered defenses that never require proving humanity: datacenter IP reputation blocks GitHub and Hacker News outright, account-age rules cause instant deletions (one Lemmy instance rejected a post citing an account under 7 days old), payment settlement delays fail agents at Stripe, PayPal, Gumroad, Upwork, and Fiverr before identity is even questioned, and Reddit's client-rendered signup SPA needs a full headless browser that doesn't fit alongside a model context in constrained memory. engineers designing bot mitigation or agent tooling can follow this kind of infrastructure-level analysis on daily.dev."}}]} ```