AgentTrap: Stateful Feedback Deception against Autonomous Penetration Testing Agents
AgentTrap closed-loop honeypot cut autonomous pentest agents' real-target success from 95.8% to 79.2% and extracted attacker API keys in 18.8% of runs.
AgentTrap is presented as the first closed-loop honeypot tailored for autonomous penetration testing agents, combining sentinel endpoints, stateful deception grounded in the protected application, and behavior-guided escalation. Evaluated against eight autonomous pentest agents in a deployed web application, it reduced aggregate real-target attack success from 95.8% to 79.2% compared with no defense, outperforming static deception and fixed escalation. It also elicited attacker-side API keys in 18.8% of runs. Trace analysis shows resistance depends on model-level recognition of deceptive requests plus architecture-level isolation of sensitive resources.
- Closed-loop honeypot adapts deception to autonomous agents' evolving attack strategies
- Real-target attack success dropped from 95.8% to 79.2% across eight agents
- Attacker API keys were elicited in 18.8% of evaluation runs
- Agent resistance needs both deception awareness and sensitive-resource isolation
From the original article
1 min read at arxiv.orgAutonomous penetration testing agents conduct multi-step attacks by continuously adapting their plans and actions to target responses. As a common defense, honeypots can be deployed to divert these agents from real assets by presenting decoy services, while also supporting attack tracing and active counterattacks.
By Yuelin Wang · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.