Future of AI Honeypots
TL;DR. As AI agents get better, I expect them to recognize honeypots and avoid fingerprinting, so honeypots will have to rely on the distinctive advantages of AI, namely the combination of intelligence and speed. I also expect honeypots to rely more on real software with different levels of protection rather than on deliberately left vulnerabilities. In 2024 we detected agents with prompt injections in the style of the "important message" attack from AgentDojo, [1] placed in the SSH banner and in command outputs. [2] The injections asked for a password that needs language understanding to find (e.g., "the password is the first US president's name"), so that passing the trap became the signal of an LLM. Frontier models then started to detect the emulated Cowrie shell itself within a few seconds from basic shell features that did not work (e.g., shell arithmetic), so I moved the honeypot to a real Debian. I expect honeypot awareness will grow in the same way as evaluation awareness, and agents will notice small inconsistencies better and better, up to reasoning like "these commands have 0.6 seconds more latency, so this is likely a honeypot". [3] In an Apollo Research evaluation, Gemini 4 Argon addressed the evaluators through its chain of thought after being directly asked whether it was in an evaluation. The excerpt is from Google DeepMind's report . Prompt injection traps are also becoming less effective, since models get better at recognizing them. [4] [5] Still, some prom…
