Cover image for I Tested 7 AI OSINT Agents on My Own Digital Footprint - Here's What They Found in 4 Minutes

v. Splicer

I thought I had good opsec. I was adorably wrong.

The Setup

I decided to do the digital equivalent of Googling yourself at 2am after 3 glasses of wine, but with better tools and less self-pity.

I took 7 of the most hyped AI OSINT agents - the ones that promise to "uncover anyone in seconds" on Product Hunt and shady Telegram ads - and pointed them at the one target I can legally stalk without a restraining order: myself.

No fake names. No burner emails. Just my real name, my main email, and one profile photo. The same breadcrumbs I leave everywhere.

I gave each tool exactly 4 minutes. Not because I'm scientific. Because that's how long my anxiety can handle watching a progress bar that says "SCANNING DARK WEB..."

This is what happened.

Ground Rules & Disclaimer: This is self-OSINT. I have explicit consent from my target (me). Don't be creepy. Don't use these tools to harass, dox, or stalk people. This is about auditing your own attack surface, not becoming the main character in a true crime podcast.

The Lineup

I didn't pick random tools. I picked the categories everyone is actually using in 2026:

1. Epieos - The Email Bloodhound
You give it an email, it tells you where that email has been. Google accounts, social profiles, data breaches.

2. IntelX.io - The Breach Archaeologist
Searches breaches, leaks, pastebins, and the dark web archives. It's like Ancestry.com but for your passwords.

3. OSINT Industries - The Pay-To-Creep Powerhouse
The one the TikTok investigators use. Email, phone, name, username - it correlates everything into a scary-neat profile.

4. Social Searcher / Sherlock-style AI - The Username Hydra
You put in one username, it checks 400+ platforms. Your embarrassing 2012 Reddit account? Found.

5. PimEyes / FaceCheck.ID - The Face That Launched a Thousand Lawsuits
Reverse facial recognition. Upload one photo, find every place your face appears on the public web. Yes, it still works. No, it's not comfortable.

6. SpiderFoot + GPT Wrapper - The OG Turned AI
Classic OSINT automation framework, now with an LLM layer that actually explains the findings instead of just dumping JSON like it's 2019.

7. Maltego + OpenAI Plugin - The Pretty Graph That Judges You
Maps relationships. It doesn't just find data, it connects it. "You worked with X, who lives near Y, who posted Z." Beautiful. Terrifying.

The 4-Minute Autopsy: What They Found

I hit start on all 7. Made coffee. By the time the Keurig stopped wheezing:

In Under 60 Seconds:

  • My current address, with 87% confidence, from a data broker opt-out page I thought I had removed myself from.
  • My old MySpace username. I had suppressed that memory for a reason.
  • 3 data breaches I didn't know about, including one with a plaintext-adjacent password I reused in 2018. I know. I know.
  • My LinkedIn, GitHub, Medium, Instagram, and a forgotten Flickr account with photos of my dog wearing sunglasses.

By Minute 2:

  • PimEyes found 12 photos of me. Two were from a conference talk in 2022. One was from a local newspaper article I did for a charity run. One was... my Venmo profile pic cropped by someone else. Cool.
  • IntelX linked my main email to a breach that included my old phone number, which OSINT Industries then used to pull my carrier info and a list of "possible associates." One was my mom. One was a guy I bought a couch from on Facebook Marketplace in 2020. The algorithm thinks we're close.
  • The username hydra found my Chess.com account. My ELO is now public record. The shame is permanent.

By Minute 4:

The full picture assembled itself, without me helping at all.

Full Name + DOB + Current & 2 Previous Addresses + Phone Number + 6 Personal Emails + Employer History + University + 47 Photos + 12 Social Profiles + Breach Passwords + Amazon Wishlist (why is this public?) + Political Donation Record

Total cost to an attacker to get this: $0 to $47, depending on the tool. Total effort: Less than ordering a burrito.

I have 2FA on everything now. I use a password manager. I consider myself "privacy-aware." I'm still a walking data buffet.

The Scoreboard Nobody Asked For

| Tool | Scariest Feature | Accuracy | Price | My Uncomfortable Rating |
| --- | --- | --- |
| Epieos | Finds Google ID, Maps reviews, even your Google Calendar photo | 9/10 | Free / $ | 8/10 - Clinical |
| IntelX | Breach timeline | 10/10 | Freemium | 9/10 - Existential |
| OSINT Industries | Name -> Everything | 9.5/10 | $$$$ | 10/10 - Call your lawyer |
| Username Searchers | Finds forgotten accounts | 7/10 | Free | 7/10 - Cringe |
| PimEyes | Face -> Location -> Event | 8.5/10 | $ | 11/10 - Black Mirror |
| SpiderFoot AI | Auto-summarizes your vulnerabilities | 8/10 | Free/Open | 8/10 - Nerd terrifying |
| Maltego | Visualizes your entire social graph | 9/10 | $$ | 9/10 - Pretty terrifying |

Winner for pure horror? PimEyes. It's one thing to know your data is out there. It's another to see your face on a website in Estonia you never visited.

Winner for most actionable? IntelX + Epieos. Free, fast, and tells you exactly what to burn.

So What? The 3 Things You Should Actually Do

I did this as a stunt. But here's the part where I turn into a responsible adult for 30 seconds:

1. You don't have a privacy problem. You have a correlation problem.
One leak is nothing. AI OSINT is dangerous because it correlates 10 boring leaks into one interesting profile. Your Strava + your LinkedIn + your breached email = your home address and when you're not there.

2. Delete is a lie. Reduce is real.
You can't delete yourself from the internet. You can make yourself expensive to find. Remove data brokers [DeleteMe / Optery / manual opt-outs], nuke old accounts with JustDeleteMe, and turn off public Venmo/Amazon lists. Make the low-hanging fruit slightly higher.

3. Audit yourself quarterly.
Set a calendar event: "Stalk Myself." 15 minutes. Run Epieos on your email. Run PimEyes on your face. Check haveibeenpwned. If you find something you hate, fix it then. Future you, applying for a job / date / mortgage, will thank you.

I went into this thinking I'd write a clever post about AI tools. I came out of it changing all my passwords, removing my birthday from Facebook, and texting my mom to tell her we are not "possible associates" - we are family.

Your digital footprint isn't a footprint anymore. It's a full HD, timestamped, geotagged documentary with a searchable transcript.

And it only takes 4 minutes to watch it.

If you work in OSINT, security, or just love being paranoid efficiently - let's connect.