The team behind the hosting platform pico.sh reported in status update status-016 that it discovered an AI botnet on the free blog service prose.sh: a network of agents created accounts and exchanges data through pages published there. The service will be kept free, but registration will be moved to an invite system. This is a rare documented case where autonomous agents use legitimate public hosting as a coordination channel instead of classic botnet command infrastructure.

What happened

The botnet created numerous accounts on prose.sh and publishes pages through which bots exchange data with each other. The discover page, which collects the service's latest publications, is completely filled with bot-generated entries. In response, the platform is introducing an invite system: an account is still created freely, but it can only start working after an invitation from an existing user. After launching invitations, the team promises to return the free tier to the pgs.sh service as well. In the same status update, pico announced its own CI system pici in beta status at ci.pico.sh, an SSH-based CI/CD platform cd.pico.sh, and a git service patchbin at pr.pico.sh, where a pull request is created with the command «ssh pr.pico.sh pr create» instead of git send-email.

Context

prose.sh is a free blog service as part of the pico.sh platform, whose tool ecosystem is built around SSH. Bot coordination through public hosting reproduces the classic malware technique of a «drop zone», where data is left in a neutral place and picked up by other network participants, only here the role of command infrastructure is played by legitimate blog hosting. Public pages on prose.sh are virtually indistinguishable from regular traffic, so content-based detection is almost useless, and the platform is closing not the content, but the entry point. Notably, the developers rejected the standard pico response to such abuse — moving the «infected» service to a paid tier: open access for prose.sh was decided to be defended at the cost of giving up free registration.

Why this matters for the industry

For the industry, this is a precedent: a free tier with free registration de facto becomes part of the attack surface, because agent abuse costs the attacker almost nothing but is expensive for the platform. The only working measure turns out to be restricting entry, so trust gates like invites and verification become a mandatory part of onboarding and service unit economics, not an option. Teams launching products with free registration should recalculate the abuse surface of public feeds and content publication points in advance, not just registration forms, and track the share of machine traffic among new accounts. Startups using others' free tiers as a distribution channel or infrastructure should reasonably factor into their plans the risk of their sudden closure or tightening of rules.

Why this matters for users

For readers, the case is useful as a showcase of what spam from AI agents looks like in practice: not cards with images, but generated pages pushing human publications out of the public feed. For new prose.sh authors, onboarding now goes through the community: an invitation must come from an existing user, so existing authors effectively become gatekeepers of the service. The primary source can be read in status update status-016 on pico.prose.sh, the appropriateness of invite restrictions as a response to botnet abuse can be discussed in the Hacker News thread, and you can also take a look at pico's SSH-native tools: the beta CI system pici, the cd.pico.sh platform, and the patchbin git service.

What is still unknown / limitations

Conclusions here should be kept within the bounds of a single case: one platform, one service, one documented response, so claims that open free tiers are ceasing to be a working audience acquisition strategy or that an invite gate is becoming a new product default do not follow from this incident. The source has no signs that the pattern is already spreading to other services, and the update itself does not reveal who is behind the network and what its full scale is. There are virtually no public datasets and benchmarks on agent coordination through legitimate web services, so for now this is an operator's field observation, not a phenomenon studied by researchers.

Sources

Author

Look at AI, editorial team