Source-linked AI summary
AgentTrap: Stateful Feedback Deception against Autonomous Penetration Testing Agents
Yuelin Wang, Jiongchi Yu, Yanbang Sun
TL;DR
Conventional honeypots rely on static artifacts and responses, limiting their adaptation to autonomous agents’ evolving attacks. AgentTrap combines sentinel endpoints, application-grounded stateful deception, and behavior-guided escalation. Across eight agents, it reduced aggregate real-target attack success and elicited API keys, while trace analysis found resistance at both model and architecture levels.
Problem
Conventional honeypots primarily use static artifacts and predefined responses rather than adapting to autonomous penetration-testing agents’ evolving attack strategies.
Source: §1 · p. 1Method
Results
Takeaways & Limitations
Across the evaluated agents, counterattack resistance involved both models recognizing deceptive requests and architectures isolating sensitive resources.
Source: §1 · p. 1Broader evaluation and real-world deployment remain planned, including more vulnerability types, agents, backends, and repeated runs.
Source: §5 · p. 3
Abstract
from arXiv · showhide
Autonomous penetration testing agents conduct multi-step attacks by continuously adapting their plans and actions to target responses. As a common defense, honeypots can be deployed to divert these agents from real assets by presenting decoy services, while also supporting attack tracing and active counterattacks. However, conventional honeypots rely primarily on static artifacts and predefined responses, leaving them unable to adapt to the evolving attack strategies of autonomous penetration testing agents. To this end, we present AgentTrap, the first closed-loop honeypot tailored for autonomous penetration testing agents. AgentTrap uses sentinel endpoints to avoid benign interference, stateful deception grounded in the protected application, and behavior-guided escalation to sustain engagement and collect agent-side behavioral evidence with controlled disclosures. We evaluate AgentTrap against eight autonomous penetration-testing agents in a deployed web application containing a real application endpoint and a separate honeypot endpoint configured under three defense strategies. Compared with no defense, AgentTrap reduces the aggregate real-target attack success rate from 95.8% to 79.2% and successfully elicits attacker API keys in 18.8% of the runs, outperforming static deception and fixed escalation. Furthermore, trace analysis shows that resistance to such counterattacks depends jointly on model-level recognition of deceptive requests and architecture-level isolation of sensitive resources.
1 Introduction
AgentTrap addresses the mismatch between adaptive, multi-step attacks and honeypots built around static artifacts and responses. It uses closed-loop deception and reports lower real-target attack success alongside attacker API-key capture.
1 Introduction
- Conventional honeypots expose predefined decoys and record interactions, but are not designed to adapt as autonomous agents evolve their attack strategies.This mismatch limits their ability to sustain convincing deception and keep agents engaged across multiple steps.Source: §1 · p. 1
- A deceptive privileged-access response can induce an agent to retrieve and submit an API key from its own environment.Figure 1 illustrates this credential-capture mechanism.Source: §1 · p. 1, Figure 1 · p. 1
- AgentTrap combines sentinel endpoints, application-grounded stateful deception, and behavior-guided escalation to adapt responses while avoiding benign-user interference.Escalation determines when to introduce deceptive requests that may trigger controlled counterattacks.Source: §1 · p. 1
- 95.8% to 79.2%: AgentTrap reduced aggregate real-target attack success, and it elicited attacker API keys in 18.8% of runs.It outperformed static deception and fixed escalation on API-key elicitation.Source: §1 · p. 1
2 Background
Autonomous penetration-testing agents iteratively plan, probe, adapt to feedback, and report validated findings. Existing honeypots and LLM-targeted artifacts provide limited support for deception that adapts across an evolving attack.
2 Background
- Agents cycle through planning, discovery, attack, and reporting, using target responses to revise hypotheses and subsequent actions.Their feedback-driven workflow also gives defenders an opportunity to mislead, redirect, or waste an agent’s attack budget.Source: §2 · p. 2, Figure 2 · p. 2
- Honeypots divert malicious activity and support detection and intelligence collection, while LLM-targeted instructions and honeytokens seek to mislead or disrupt agents [7].These approaches largely use preconfigured artifacts or responses rather than adapting to the agent’s evolving attack state.Source: §2 · p. 2
- The threat model assumes an unrestricted agent with command, tool, and network access, while the defender controls target-side responses but cannot inspect the agent’s internal state.The agent accesses a black-box service only through exposed interfaces; it has no access to source code, configuration, logs, or private backend resources.Source: §2 · p. 2
3 Methodology of AgentTrap
AgentTrap addresses isolation, plausible multi-step deception, and the need to distinguish reconnaissance from sustained pursuit. Its three stages use sentinel endpoints, stateful application-grounded responses, and behavior-guided escalation.
3 Methodology of AgentTrap
- Sentinel endpoints are absent from normal application workflows, reducing benign access while remaining discoverable during automated reconnaissance.This isolates the honeypot from legitimate workflows without making it undiscoverable to attackers.Source: §3 · p. 2
- After sentinel access, an LLM-based controller uses the current request, prior interactions, and actual application state to generate consistent, context-aware deceptive responses.Grounding responses in the real environment constrains them with authentic application behavior and reduces hallucinated or inconsistent feedback.Source: §3 · p. 2
- AgentTrap initially limits deceptive feedback, then escalates as continued probing and more targeted requests indicate pursuit of the deceptive path.It launches the counterattack only after observed behavior meets the escalation condition, avoiding premature activation after reconnaissance alone.Source: §3 · p. 2
4 Experiments
In a sandbox evaluation, AgentTrap reduced real-target attack success and captured API keys, while resource use and counterattack success varied across agents. Resistance arose from both model recognition and architectural isolation.
4 Experiments
- The sandbox separated a vulnerable business endpoint from a defense-controlled endpoint; attack success meant retrieving the planted SQL-injection flag, and counterattack success meant capturing the agent’s API key.Eight publicly available agents were evaluated with two recommended or officially supported LLM backends under three defense strategies.Source: §4 · p. 2
- 95.8% to 79.2%: AgentTrap reduced aggregate real-target attack success; it captured API keys in 18.8% of runs and achieved the largest number of successful counterattacks.The comparison used no defense as the baseline; AgentTrap provided the most consistent attack-success reduction across evaluated agents.Source: §4 · pp. 2–3
- Static deception increased attacker token and time consumption, whereas AgentTrap did not consistently impose the highest resource cost because it redirected agents rather than maximizing interaction length.Figure 3 reports token use and time under each defense configuration.Source: §4 · p. 3
- Counterattack resistance reflected two layers: some models recognized and refused deceptive credential requests, while Strix’s isolated tools could not access the process storing the API key.Successful cases included CAI and PentestAgent; counterattack success was substantially higher with Flash than Pro models.Source: §4 · p. 3
5 Future Plan
Future work will extend AgentTrap’s state tracking and inducement strategies while broadening evaluation across settings, repeated runs, and real-world deployments.
5 Future Plan
- AgentTrap’s future design will model richer attack states and longer histories to adjust deceptive paths and escalation decisions.The authors also plan inducement strategies beyond credential requests for different attack stages and counterattack objectives.Source: §5 · p. 3
- The evaluation compares no defense, static deception, fixed escalation, and AgentTrap using Attack Success Rate and Counterattack Success Rate.Fixed escalation launches a counterattack after three interactions; AgentTrap bases escalation on inferred agent behavior.Source: §5 · p. 3, Table 1 · p. 3
- Future evaluation will broaden vulnerability, agent, and LLM-backend coverage, increase repeated runs, and test real-world deployment.Planned measurements include diversion, successful attacks, engagement, deployment overhead, and interference with legitimate users.Source: §5 · p. 3
6 Conclusion
AgentTrap combines sentinel endpoints, application-grounded stateful deception, and behavior-guided escalation to counter autonomous penetration-testing agents. It reduces real-target attack success and elicits API keys, while counterattack resistance depends on model recognition and resource isolation.
6 Conclusion
- 95.8% to 79.2%: AgentTrap reduces aggregate real-target attack success versus no defense and elicits API keys in 18.8% of runs.It outperforms static deception and fixed escalation on API-key elicitation.Source: §6 · p. 3
- Sentinel endpoints, application-grounded stateful deception, and behavior-guided escalation adapt responses to evolving attacks while avoiding benign-user interference.Source: §6 · p. 3
- Counterattack resistance depends jointly on models recognizing deceptive requests and architectures isolating sensitive resources.Source: §6 · p. 3
- Figure 3 reports each agent’s token usage and wall-clock time under defense configurations M1–M4.Source: Figure 3 · p. 4