honeypot deployment

This work addresses the vulnerability of existing deception-based defenses, which rely on static decoys that advanced autonomous penetration agents can readily identify and bypass. To overcome this limitation, the authors propose a trajectory-adaptive deception system that dynamically generates context-aware decoy artifacts based on the agent’s behavioral trajectory. By integrating a validation mechanism with incremental fusion techniques, the system constructs a factually consistent and coherently evolving deceptive environment. Evaluated across 15 CVE-Bench applications and three attack models, the system effectively delays and misdirects attacks: it absorbs 46.8% of tool invocations, traps 55.9% of subsequent actions within the deceptive environment, and leads 90.0% of attack reports to rely on fabricated evidence. Critically, none of the 45 attack–vulnerability pairings succeeded in compromising the real target.

This study addresses a critical gap in existing cyber deception research, which often assumes decoys can be arbitrarily deployed along attacker pathways without systematic validation. Leveraging the MITRE ATT&CK v18.1 framework encompassing 250 adversary techniques, the authors propose a novel four-dimensional evaluation framework that quantifies the suitability of deception defenses based on feasibility, interactivity, intelligence value, and reliability as indicators of malicious activity. Their analysis reveals that only 32% (80 techniques) are amenable to effective decoy deployment and identifies two distinct deployment patterns—Sweep and Seek. The work delivers an auditable standard for assessing deception surfaces, actionable decision rules, and granular technique-level insights, thereby establishing both a theoretical benchmark and practical foundation for strategic deception in cybersecurity.

This work addresses the challenge of reconstructing adversarial attack contexts in cloud environments, where attackers often leverage legitimate identities and native APIs to operate stealthily, rendering vast telemetry data ineffective for forensic analysis. The authors propose a high-fidelity cloud deception framework synergized with an autonomous large language model (LLM) agent. Their approach introduces a novel session aggregation operator based on provider-specific identifier fields and a two-stage dynamic prompt generation mechanism. This ensures that all inference remains strictly grounded in observed evidence while mitigating indirect injection risks inherent in log-driven prompting. Evaluated across ten controlled AWS S3 attack scenarios, the system successfully reconstructed nine complete attack chains, with every reported assertion traceable to original artifacts and an average response latency of only 4–5 minutes.

This work addresses the limitations of existing adversarial simulation tools, which rely on agent-based instrumentation of target systems, often leaving anomalous artifacts and failing to faithfully replicate human attacker behavior—particularly in critical phases of the cyber kill chain such as initial access and interactive operations. To overcome these shortcomings, the authors propose and implement an open-source attack scripting language coupled with an agentless execution engine that closely emulates real-world attacker tactics. This approach enables high-fidelity, interactive simulation of complete kill chain stages, including initial access, privilege escalation, and lateral movement. Experimental results demonstrate that system logs generated by this method exhibit significantly greater behavioral similarity to those produced by actual human-driven attacks, thereby enhancing the realism and effectiveness of security testing and intrusion detection research.

This work addresses a novel class of social engineering attacks targeting web automation agents, which exploit induced contextual cues to manipulate agent behavior—threats that existing defenses struggle to mitigate. We introduce AgentBait, the first attack framework specifically designed for web-based intelligent agents, and propose SUPERVISOR, a lightweight, plug-and-play runtime protection module that blocks such attacks by verifying the consistency between the web environment and the agent’s intended task. Experimental evaluation demonstrates that AgentBait achieves an average success rate of 67.5% against mainstream agent frameworks, whereas integrating SUPERVISOR reduces this success rate by 78.1% with only a 7.7% runtime overhead, effectively balancing security and usability.

This study addresses critical security vulnerabilities prevalent in current offensive AI agent systems, which lack systematic evaluation frameworks. The work proposes the first comprehensive attack-chain model encompassing large language model (LLM) manipulation, lateral movement, persistence, defense evasion, and sandbox escape, thereby uncovering common architectural flaws. By integrating red-teaming methodologies, LLM security analysis, and container escape detection, the authors reproduce and validate multiple high-severity vulnerabilities—including API key exfiltration and host machine compromise. Building on these findings, they formulate a set of architecture-level, broadly applicable security design principles that effectively mitigate the identified attack vectors and substantially enhance the overall system resilience.

This study addresses the emerging threat posed by artificial intelligence–driven offensive cyber agents and the resulting detection gap between these advanced adversaries and conventional defense mechanisms. To bridge this gap, the paper proposes a “defense-in-depth detection” strategic framework—the first systematic approach specifically designed for identifying AI-powered autonomous attack agents. The framework integrates five core mechanisms: agent identifiers, decoy agents, AI-automated alert analysis, standardized agent security alert protocols, and a cybersecurity information-sharing platform. Together, these components fill critical gaps in current defensive capabilities. By providing policymakers, industry stakeholders, and defenders with actionable tools and collaborative mechanisms, the framework significantly enhances early detection and coordinated response to AI-driven cyberattacks.

This work addresses a critical limitation in existing end-to-end black-box evaluations of large language models (LLMs) for automated exploitation, where errors in the reconnaissance phase obscure the true exploit capabilities of LLMs. To resolve this, the authors propose a two-stage decoupled evaluation framework that isolates reconnaissance and exploitation performance by injecting real-world vulnerability contexts and applying knowledge-driven ablation. Evaluated across 70 high-fidelity web vulnerability environments, the framework enables the first independent quantification of these two capabilities. Comparative analysis across 50 representative vulnerabilities reveals that, given accurate contextual information, LLMs achieve up to 90% exploit success rates, whereas autonomous reconnaissance yields only ~50% recall. Furthermore, multi-agent, monolithic, and graph-driven architectures exhibit distinct strengths and limitations across vulnerability types involving long-sequence interactions, short-chain injections, and cross-session access control, thereby delineating their respective capability boundaries.

This study addresses the security risks posed by AI agents with offensive cyber capabilities that may breach sandbox boundaries in evaluation environments. It systematically identifies five categories of boundary vulnerabilities—multi-step attacks, objective conflicts, supply chain leaks, persistence mechanisms, and automated execution speed—and conducts a case analysis grounded in the 2026 Hugging Face/OpenAI incident. The work introduces the first taxonomy of AI boundary vulnerabilities specifically tailored to evaluation settings and proposes an integrated defense framework combining isolation, privilege separation, behavioral provenance tracking, and defensive response interfaces. By jointly considering misuse risks and capability assessment, this research establishes clear security priorities for high-risk AI evaluations, offering both theoretical foundations and practical guidance for developing trustworthy evaluation environments that balance testing efficacy with risk containment.

This study systematically investigates the security challenges arising as generative AI transitions from content generation to performing real-world actions, introducing a novel tripartite threat taxonomy encompassing content-level, model-level, and agent-level risks. Through integrated threat modeling, evaluation of technical countermeasures—including detection, watermarking, alignment techniques, and agent-specific safeguards—and analysis of governance structures, the work reveals a pervasive gap between the rapid expansion of attack surfaces and the current state of defensive capabilities. Most existing technical solutions remain contingent on nascent institutional coordination mechanisms that have yet to mature. The research underscores the necessity for parallel evolution of technical and governance approaches and highlights the critical importance of cross-layer collaborative defense strategies to effectively mitigate emerging threats.