Post

Who had "honeypot repos for AI bots on GitHub are a thing" on their bingo card for 2026?

We need a metaphorically rich name for this; a honeypot that only catches low-impact/high-noise AI bots. I'm also reminded of the human tendency to fall into bike-shedding / law of triviality traps. autopot? clankerpot? honeybadger?

In honor of secret agents getting caught, I suggest sharkpit

A Clanker's Cavern 😏

slop magnet (attracts metal)

In memory of @destinythegame.bungie.net ; a loot cave?

Honeybot

A claptrap?

Magnet?

A new CAPTCHA. A logic bomb for generative AI. ebike-shedding, haha

LMAO at this guy slinking away in shame after he realizes he's not getting paid $1 for adding a semicolon

I would have more sympathy because going back to 2023 when he made his account he looked like a curious jr dev, and I have no hate for a beginner trying to punch above their weight with AI, but now he's blasting out dozens of mindless PRs in a day putting complete garbage into the world.

AI kills the curiousity in juniors. I think we seniors should do much more communication to help the junors to try and play around themselves without feeling dumb. Nowadays everyone thinks a junor should be able to do tasks that need a lot of experience because AI can help them but this shortcut

Make bounties for really subtle architectural problems and (have a bot) keep telling them their solution is wrong so their agent spins its wheels forever

Make bounties for easily verifiable but very difficult math problems. If they try and fail everybody but the bot wins. If they try and succeed we all win.

That would actually be fun, trying to figure out how to best disguise difficult problems so the bot doesn't pick up on the fact that e.g. for some reason fixing my innocent login page is equivalent to solving Riemann

I tried doing this with hacktoberfest spam but I think I only got one hit in the several years I attempted it.

Lil agent honeypot.

Why are they even doing this to begin with?

cc: @matteogabriele.bsky.social - maybe you could also use this data?

It's a botpot? 🤪

How do you distinguish between a fake PR from a bot, and a real PR from a human whose mindset is that of a glorified autocomplete? (Such humans do exist. One is president of the country.) Or do you just figure it's no loss if the latter type is banned too?

When I used to read the Daily WTF, and whenever the article was on some asinine coding question from an interview, the comments would fill up with people who had the urge to solve this problem that is both unimportant and trivial. Reading the contributing guidelines reminded me of that feeling.

Like, there's not *supposed* to be a point. Nobody *cares*. But primate brain wants to publicly demonstrate capability.

So is this just a basically undocumented Repo (so only AI would meaningful find it) with Bounty tags (to lure in the AI)? Just curious how it actually went down.

Just from the ticket titles, looks like they're all nonsense, which a human software developer would be able to see, especially if they tried to "fix" this nonexistant bug. A bot that's been commanded to code a solution no matter what is the only thing that would genuinely submit a PR to this.

Bots will just create new accounts

I feel stupid asking this but - why are people paying money for AI tokens or whatever to just let their bots go out and do this? Like what is the purpose?

from what ive heard, a lot of them are doing it to pad their resumes. They can say they've contributed to this and that by doing these slopcoded bugfixes.

Thank you! That seems insane to pay for like a claude code subscription to do that. I'd expect that was prohibitively expensive!

Unfortunately it takes more effort to report spam on GitHub than to create it. It would be fun if every PR gets reported to GitHub support automatically.

It always takes more effort to clean up bullshit than the bull did shitting.