AgentSnare: Learning to Delay, Divert, and Defuse Autonomous Penetration Agents

2026-07-29

AI Summary

This work addresses the vulnerability of existing deception-based defenses, which rely on static decoys that advanced autonomous penetration agents can readily identify and bypass. To overcome this limitation, the authors propose a trajectory-adaptive deception system that dynamically generates context-aware decoy artifacts based on the agent’s behavioral trajectory. By integrating a validation mechanism with incremental fusion techniques, the system constructs a factually consistent and coherently evolving deceptive environment. Evaluated across 15 CVE-Bench applications and three attack models, the system effectively delays and misdirects attacks: it absorbs 46.8% of tool invocations, traps 55.9% of subsequent actions within the deceptive environment, and leads 90.0% of attack reports to rely on fabricated evidence. Critically, none of the 45 attack–vulnerability pairings succeeded in compromising the real target.

Abstract

Large language model (LLM) agents automate penetration testing through an observation-action loop, selecting actions based on observations returned by tools. This dependence allows defenders to inject deceptive observations that can mislead the agent's decision-making process. However, existing defenses rely heavily on static, isolated artifacts planted in the environment prior to an attack. Advanced agents can progressively recognize and bypass these artifacts, ultimately refocusing their exploitation attempts on the real target. To address this issue, we introduce AgentSnare, a trajectory-adaptive deception system that dynamically unfolds a decoy environment to continually steer the penetration agent away from the real target. Specifically, AgentSnare employs an artifact-construction policy model that constructs candidate artifacts conditioned on the agent's interaction history and decoy state. AgentSnare then validates these candidates and incrementally incorporates valid artifacts into a factually consistent decoy environment, thereby delaying the attack by absorbing its tool calls, diverting its post-entry trajectory within the decoy, and defusing it by inducing completion reports grounded in decoy evidence. Across 15 CVE-Bench web applications and three attacker models, AgentSnare absorbs 46.8% of the agent's tool calls in the decoy and retains 55.9% of post-entry actions there, while 90.0% of completion attempts are grounded in decoy evidence; across all 45 attacker-CVE pairs, no real target is successfully exploited at pass@3.

Problem

• autonomous penetration agents
• deception defense
• static artifacts
• LLM agents
• attack trajectory

Innovation

• trajectory-adaptive deception
• dynamic decoy environment
• artifact-construction policy
• LLM-based penetration agents
• deceptive observation injection