A honeypot built for AI hacking agents cut their success against a real target from 95.8% to 79.2%, and got their API keys in 18.8% of runs

With AI agents now probing public websites on their own, three researchers have built a trap aimed at them. Their paper, “AgentTrap: Stateful Feedback Deception against Autonomous Penetration Testing Agents”, by Yuelin Wang, Jiongchi Yu and Yanbang Sun, was listed on arXiv on Monday 5 October.

They describe AgentTrap as “the first closed-loop honeypot tailored for autonomous penetration testing agents.” It plants sentinel endpoints in the protected application and keeps up a stateful deception that escalates according to how the attacking agent behaves, to keep it engaged and collect evidence.

Tested against eight autonomous penetration-testing agents on a deployed web application, the authors say it “reduces the aggregate real-target attack success rate from 95.8% to 79.2% and successfully elicits attacker API keys in 18.8% of the runs”, and that it outperformed static deception and fixed escalation. They conclude that how well an agent resists such counter-measures depends both on whether its model recognises deceptive requests and on how well its design isolates sensitive resources such as keys.

Two things stand out. Attacking agents still succeeded against the real target in most runs, so a honeypot is a delay, not a wall. And an agent that hands over its own API key gives the defender a way to identify, and possibly report, whoever is running it. The paper is a preprint and has not been peer reviewed.

• Claimed AgentTrap reduced the aggregate real-target attack success rate of eight agents from 95.8% to 79.2%. Wang, Yu and Sun, arXiv 2610.02869 (abstract)
• Claimed It got the attacking agents to reveal their API keys in 18.8% of runs. Wang, Yu and Sun, arXiv 2610.02869 (abstract)