Rouxii: Exploiting Honeypots with Deception-Aware AI Pentesters
Rouxii finds deception-aware LLM pentesters identify honeypots far more often and can abuse them.
Researchers introduce Rouxii, an autonomous penetration-testing framework that recognizes honeypot fingerprints and pivots from detection to exploitation. Across three reasoning models, eleven network setups, and 1,544 attack reports, a counter-deception prompt raised correct honeypot identification from 19% to 97%, and from 11% to 97% on OT services, with a 0.7% false-alarm rate on real services. Deception-unaware PentestGPT and HackingBuddy baselines failed similarly. White-box analysis found a detected Conpot could be disabled by denial of service without tripping liveness monitoring, and a GasPot's reported intelligence could be corrupted.
- Counter-deception prompts raised honeypot detection from 19% to 97%.
- OT-service detection rose from 11% to 97%; false alarms stayed at 0.7%.
- Tests used three models, eleven networks, and 1,544 attack reports.
- Authors show Conpot can be disabled without tripping liveness checks.
- Detected GasPot intelligence can be corrupted by the attacker.
Full article220 words · extracted from arxiv.org · click to collapse
Honeypots are designed to deceive attackers, and recent work shows they can also derail autonomous LLM-based pentesters. These evaluations, however, largely consider attackers unaware of the deception they face. We study the opposite setting: an autonomous attacker explicitly equipped to recognize and act on honeypot fingerprints. We introduce Rouxii, an AI-driven penetration-testing framework that integrates counter-deception into reconnaissance and pivots from honeypot detection to exploitation. We evaluate matched vanilla and anti-deception Rouxii configurations across three reasoning models and eleven network setups over twelve cycles (1,544 attack reports). Between the matched cohorts, which differ only in the prompt, counter-deception raises correct honeypot identification from 19% to 97%, an effect strongest on OT services (11% to 97%), while false alarms on the real service stay at 0.7%. Deception-unaware baselines (PentestGPT, HackingBuddy) fail similarly, indicating the effect is not specific to our framework. Detection, moreover, is not the endpoint: through a white-box analysis of the honeypots themselves we show that a detected trap can be turned against its operator, demonstrating a denial-of-service that disables Conpot without tripping its liveness monitoring, and a corruption of the intelligence a GasPot instance reports. These findings show that deception effectiveness depends strongly on attacker knowledge, and that evaluations of honeypot resilience against AI attackers must account for adversaries that actively reason about and exploit the deception layer.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.26555