LLM-Based Penetration Testing in the Presence of Honeypots
Studies honeypot-aware budget allocation for LLM attack agents, showing detector-guided policies let agents skip deception and compromise real hosts efficiently.
The paper formalizes LLM attacker behavior against honeypots as a budgeted decision process, where agents choose to continue or skip targets when honeypot suspicion arises. A detector-guided policy lets LLM agents allocate execution budget effectively across a mixed host pool in a controlled testbed. Findings show LLM-driven attackers can reason about heterogeneous artifacts and use honeypot suspicion to guide target selection, challenging traditional deception defenses that rely on realism and obscurity against human or script-driven attackers.
30