I think this service is already pretty good, but when defending against LLM based attacks, they're a godsend. Current tools don't appear to be too discerning.
Any idea on how to roll-your-own canary token for an unsupported token provider like Cloudflare/Stripe/OpenAI? Do you just make a real Cloudflare/Stripe/OpenAI account, create an API key, and vibecode an alerting system?
I'm kinda surprised that they haven't expanded beyond their existing token providers.
They make credit cards. Obviously they're not real cards but what sort of financial wizardry is required to make that possible? And given it's vibecoded that means Claude knows how to make fake credit cards now?
If by "fake" you mean ones that pass number validation on web sites, that's easy. I wrote python code to check and generate valid numbers back in the '90s; it's a simple, well known check digit algorithm appended at the end. https://en.wikipedia.org/wiki/Luhn_algorithm.
Vibecoding has seriously eroding the trust we have in public software. Hopefully there's some of badge projects can use to clarify how much Ai was in charge of it.
I’m using the concept across AI infra in my own project https://canarygrid.shadesec.com
Related. Others?
Canarytokens: Honeypot for critical credentials, get notified when they are used (2015) - https://news.ycombinator.com/item?id=15778011 - Nov 2017 (1 comment)
I think this service is already pretty good, but when defending against LLM based attacks, they're a godsend. Current tools don't appear to be too discerning.
Thanks! We also think they’re one of the few things available that work well for agentic threats.
You might find some recent work we did on agent deception interesting as well: https://blog.thinkst.com/2026/09/getting-agents-to-tell-on-t...
That’s a really good idea, I love that they even do fake bank cards.
I feel like a self-hosted version would be better though. Having to phone home to their servers could give the game away.
You can totally host it yourself!
https://github.com/thinkst/canarytokens
Any idea on how to roll-your-own canary token for an unsupported token provider like Cloudflare/Stripe/OpenAI? Do you just make a real Cloudflare/Stripe/OpenAI account, create an API key, and vibecode an alerting system?
I'm kinda surprised that they haven't expanded beyond their existing token providers.
That's the issue. If the first-parties don't provide a means to mint canaries you have to mint your own real keys.
They make credit cards. Obviously they're not real cards but what sort of financial wizardry is required to make that possible? And given it's vibecoded that means Claude knows how to make fake credit cards now?
>Claude knows how to make fake credit cards now
If by "fake" you mean ones that pass number validation on web sites, that's easy. I wrote python code to check and generate valid numbers back in the '90s; it's a simple, well known check digit algorithm appended at the end. https://en.wikipedia.org/wiki/Luhn_algorithm.
No I mean ones that are actually connected to Visa's network and you get an API call from Visa when someone uses them.
They’re real virtual cards actually. Source: I added the feature
This feature was removed at some point and I guess added back? What happened there? It's my fav feature :).
Also what service do you use to mint endless virtual cc numbers?
1 reply →
> given it's vibecoded
Why is this a given? This service has been around for longer than LLMs have been a thing.
Vibecoding has seriously eroding the trust we have in public software. Hopefully there's some of badge projects can use to clarify how much Ai was in charge of it.
- No LLMs
- LLMs as tools
- LLMs decided some things
- YOLO vibecoded
1 reply →
this is absolutely not a given, i've been using canarytokens for years!
blog posts date back to at least 2015: https://leonjza.github.io/blog/2015/09/10/canarytokens---the...
There are many, many services for programmatically issuing credit cards that you can control from code. For example: https://stripe.com/issuing
> given it's vibecoded
I've been using it since 2015