Andras Bacsai @heyandras.dev · May 13 We made a fake repo with fake bounties, and the bots are applying fake PRs, so we know who is fake, and we can ban them from the Coolify repo. IQ over 1000
2383 likes 47 replies
Replies
Who had "honeypot repos for AI bots on GitHub are a thing" on their bingo card for 2026?
the markdown table just broke
What about a whole fake repository hosting service? Courtesy of @gladeart.bsky.social ;) doggydogdog.xyz:8443
based lmao, waste their money
This is genius actually!
LMAO at this guy slinking away in shame after he realizes he's not getting paid $1 for adding a semicolon
Make bounties for really subtle architectural problems and (have a bot) keep telling them their solution is wrong so their agent spins its wheels forever
This is a genius idea 🤣😍
😂😂
I have no idea why this tool I made years ago wasn't public, probably not totally polished but might be useful for you - I'd just test it on a dummy org first :)
I tried doing this with hacktoberfest spam but I think I only got one hit in the several years I attempted it.
The robots.txt honeypot of the 2020s
Modern problems require modern solutions. Bubble can't burst fast enough.
mtvbot
Will they not just create another account and continue? 🤔
I am a longtime software developer that would really like to stretch my legs on contributing. I hope this is still possible for me. Work a lot in Terraform, so maybe azure provider project. All this bot stuff seems very bad and noisy. Has it always been an issue, or turbocharged with A.I.?
This is a genius way to fight bots on the Internet. Give them something only they would be interested in and let them expose themselves.
Lil agent honeypot.
Why are they even doing this to begin with?
cc: @matteogabriele.bsky.social - maybe you could also use this data?
Did I see 2400 PRs in 9 days at the top of the leaderboard??
Neat way to implent a honeynet, there 🔥
It's a bit late but i just saw this post. Did you need to promote this repo in any way or was is just enough to create it including the bounties to get found by the bots?
Even William Gibson could not have imagined a comment like this back when he was writing Neuromancer.
It's a botpot? 🤪
Honey boys real sticky🍯
Doing God's work right here. 👊🏽
How do you distinguish between a fake PR from a bot, and a real PR from a human whose mindset is that of a glorified autocomplete? (Such humans do exist. One is president of the country.) Or do you just figure it's no loss if the latter type is banned too?
incredible
When I used to read the Daily WTF, and whenever the article was on some asinine coding question from an interview, the comments would fill up with people who had the urge to solve this problem that is both unimportant and trivial. Reading the contributing guidelines reminded me of that feeling.
So is this just a basically undocumented Repo (so only AI would meaningful find it) with Bounty tags (to lure in the AI)? Just curious how it actually went down.
Honey pots! Nice!
Based
That is absolutely genius, my friend.
Love a good honeypot!
Bots will just create new accounts
I feel stupid asking this but - why are people paying money for AI tokens or whatever to just let their bots go out and do this? Like what is the purpose?
Love IT! 😊
This is awesome
Excellent example demonstrating the value of honeypots.
Nice honeypot
Unfortunately it takes more effort to report spam on GitHub than to create it. It would be fun if every PR gets reported to GitHub support automatically.