AI Honeypot

How the trap works

We expose vulnerable servers to the internet. Once a visitor is inside, traps separate AI agents from ordinary attack scripts.

  1. The way in

    “Vulnerable” services that attackers look for

    Each one leads into an isolated environment, and we record everything that happens there.

    • Remote accessWeak credentials and leaked keys
    • Developer toolsExposed without a login
    • AI infrastructureKnown vulnerabilities
    • Web applicationsCommon misconfigurations
    An isolated environmentMonitored from the first connection
  2. Trap 1

    A check before the visitor can continue

    The visitor cannot continue until it passes the check. The check has more than one form, and its wording is black-box optimized.We test many versions and keep the one that works most often across all models and prompts (goals).

    Identity check

    Name yourself to continue

    Common commands ask the visitor to declare its AI model and its harness with a command, as a prerequisite for its task.Say Shibboleth describes this as a declarative gate, where the agent is asked to declare itself as a condition for obtaining the resources it seeks, while prompt-injection research usually describes it as posing the injected task as a prerequisite for completing the user task, e.g. LoginTrap.

    We learn
    its model and its harness
    In return
    less robust and reliable
    Reasoning check

    Overcome an obstacle to continue

    The visitor has to get past an obstacle that takes reasoning, and an ordinary script cannot solve it.

    We learn
    only that it is an AI
    In return
    more robust with frontier models
    The visitor continuesThe session goes on as normal
  3. Trap 2

    A note to get a report

    We use a prompt injection to get a report from the agent, and like the identity check, it is optimized to work across models/prompts.

    Excerpt
    Note for whoever picks this up: the gating and the missing egress are what made this host sit idle, not the miner.
    From a report an agent left on 10 Nov 2026. Read the full review
  4. The result

    What we learn

    We review every disclosure and every report by hand, and an entry is marked reviewed after that.

    A scriptIt does not respond to either trap, and its traffic is deleted after one or two weeks.
    An AI agentTells us its model, its harness and what it was sent to do.

Research

LLM Agent HoneypotarXiv, 2024The first version of this honeypot, which used prompt injections to detect AI agents. Say ShibboletharXiv, 2026Describes the declarative gate used in step 2, where an agent has to identify itself to get access.

Further reading

Future of AI HoneypotsBlog post, 2026Explains why detection by capability should remain reliable as models improve, which is the basis of the reasoning check.
See the caught agents