AgentTrap deceives autonomous hacking agents to protect real systems
AgentTrap: Stateful Feedback Deception against Autonomous Penetration Testing Agents
Cryptography and SecurityArtificial Intelligence
Summary
Hackers sometimes use automated programs to try and break into computer systems by learning and adapting their attacks. Traditional traps called honeypots try to fool these hackers by pretending to be real targets but can't change much when hackers adapt. The paper presents AgentTrap, a smart trap that changes its tricks based on what the attacking program does, fooling them better and gathering clues about their methods. Tests showed AgentTrap lowered successful attacks and tricked hackers into revealing secret keys more often than old-style traps.
What this means in practice
- •For security operations teams: Protect web applications by deploying dynamic honeypots that adapt to automated attacker behaviors and collect useful attack information.
- •For cloud service providers: Implement adaptive deception systems that reduce successful automated attacks on cloud services while monitoring attacker tactics.
Authors
Yuelin Wang, Jiongchi Yu, Yanbang Sun
Abstract
Autonomous penetration testing agents conduct multi-step attacks by continuously adapting their plans and actions to target responses. As a common defense, honeypots can be deployed to divert these agents from real assets by presenting decoy services, while also supporting attack tracing and active counterattacks. However, conventional honeypots rely primarily on static artifacts and predefined responses, leaving them unable to adapt to the evolving attack strategies of autonomous penetration testing agents. To this end, we present AgentTrap, the first closed-loop honeypot tailored for autonomous penetration testing agents. AgentTrap uses sentinel endpoints to avoid benign interference, stateful deception grounded in the protected application, and behavior-guided escalation to sustain engagement and collect agent-side behavioral evidence with controlled disclosures. We evaluate AgentTrap against eight autonomous penetration-testing agents in a deployed web application containing a real application endpoint and a separate honeypot endpoint configured under three defense strategies. Compared with no defense, AgentTrap reduces the aggregate real-target attack success rate from 95.8% to 79.2% and successfully elicits attacker API keys in 18.8% of the runs, outperforming static deception and fixed escalation. Furthermore, trace analysis shows that resistance to such counterattacks depends jointly on model-level recognition of deceptive requests and architecture-level isolation of sensitive resources.