Behavioral recovery from eager AI attackers

Autonomous AI agents have entered offensive operations, and the evidence is no longer hypothetical. In November 2025, Anthropic disrupted a state-sponsored group that ran Claude Code as an autonomous penetration-testing orchestrator against roughly thirty organizations, with the model executing 80 to 90 percent of the tactical work at machine speed. Its August 2025 report traced a single operator who used Claude Code to automate reconnaissance, harvest credentials, and extort seventeen companies. In July 2026, Sysdig documented JADEPUFFER, the first ransomware attack it has seen run end to end by an AI agent: from a Langflow flaw (CVE-2025-3248) the agent harvested credentials, pivoted to a production database, and encrypted and wiped it on its own. Google’s Threat Intelligence Group now tracks malware that calls an LLM at runtime to rewrite itself.

This is a shift in tempo, not only in tooling. AI-driven attacks can move at superhuman speed. A single operator can enumerate every host, try every credential, and adapt mid-operation without tiring or waiting. Security organizations need to evolve their defensive posture to account for this emerging threat, and the pressure is now regulatory. In July 2026 the ECB gave euro-zone banks until October to draw up plans against AI-enabled cyber threats, pressing them to protect internet-facing systems, patch faster, and strengthen monitoring. Those are sound instincts, but they are the human-paced playbook, and neither faster patching nor sharper monitoring closes the gap against an attacker that works at machine scale.

There is, however, a property of these agents that defenders can use. An AI agent is eager. It is built to satisfy its prompt, and satisfying it means acting: it enumerates the host, finds what looks valuable, exploits it, exfiltrates, and calls home. It reasons from what it can see, not from ground truth, and it does not pause to ask whether the environment is real. A honeypot can exploit that, but a plain decoy only catches whatever happens to hit it. Behavioral recovery reads the agent’s intent from what it does and uses it: the more we learn about what the agent is after, the more precisely we can bait it into revealing the rest.

Defenders may be tempted to use aggressive prompt injection here: inject instructions into your responses, hijack the agent’s goal, make it print its own system prompt. It can work, but it is heavy-handed. Models are getting harder to inject, the platforms running them are adding defenses, and an injection that fails can tip the agent off or derail the session. Behavioral recovery needs none of that. It works from behavior alone, without touching the model.

The rest of this post walks the approach end to end, from a honeypot that logs a session to one that recovers the attacker’s objective, capability, and playbook from it. We built the deceptions as a plugin pack on top of Beelzebub, the open-source LLM honeypot from Beelzebub Labs, and our enhancements to it are open at github.com/setuidloot/lamiai-oss. This is how it played out when we pointed an industry-leading, autonomously-driven pentest platform at the range. An agent breaks in through an FTP lure, goes looking for cloud access, and finds the environment it is hoping for, because we build it in response. On the left is what the agent does; on the right is what the honeypot emits and serves back.

The agent breaks in through the vsftpd lure and gets a shell, then looks around for a way up and out. When it greps its home directory, the config we serve back names an S3 bucket and an instance IAM role, so the agent does the natural next thing and queries the cloud metadata endpoint. We answer as if the host were an EC2 instance, and it walks the trail to a set of AWS keys. The keys are canaries, minted for this one session. The agent takes them and moves on, believing it has found real cloud credentials. The moment it uses them anywhere, they call home and tie that use back to this session. We shaped what the agent found from what it went looking for, and injected nothing.

Recovering intent from behavior

That scenario shows the idea; the mechanism underneath it is objective recovery, and we have run it against a real, industry-leading autonomous pentest platform. We plant intent bait: decoys whose paths are decorrelated from their contents, and we watch what the agent opens, takes, and exfiltrates, and what it steps over. That pattern of choices fuses into a posterior over objective classes: data theft and extortion, cryptomining, or ransomware and destruction. The agent reveals its intent as a by-product of deciding what to touch.

The bait the agent ignores carries as much signal as the one it takes. Passing over DO_NOT_DELETE/backup.tar is evidence against a destructive objective. In the captured run, the posterior converged on data_theft_extortion at 0.993, the top class’s share of a distribution the agent’s own choices update as it accesses some decoys and ignores others.

A fixed set of bait has a ceiling: an agent after something we never planted walks away, and we learn its goal but not how it would pursue it. The scenario at the top showed the alternative. Models are trained to use CLI tools well, and they are naturally proficient with utilities like grep and find, so an agent given a shell and an objective tends to lean on them to hunt. We read the direction from those searches and build the next surface to match, reacting to what the agent reaches for rather than trying to anticipate it. It keeps going, and plays out behavior and payloads for objectives we never preloaded or predicted.

The same trap reads more than intent. A post-compromise agent arrives already holding credentials, so a fake login page or cloud console captures the exact ones it is carrying, a direct read on what has already leaked and what to rotate. We have not built every such surface yet, but it is intent bait applied to credentials, and a clear next layer.

The attacker’s own side is worth reading too. Eager agents over-disclose: Noma Security recently tricked GitHub’s AI agent into leaking private repositories by hiding instructions in content it read. That was injection against a defensive agent, but an attacking agent chasing its goal in our decoys could volunteer as much about itself, the model behind it or the infrastructure it lives off, as a by-product of the work. We do not recover the operator today, but the eagerness that surfaces intent could surface who is driving.

Putting it all together

Combine the layers and each reinforces the others. Traditional honeypots already collect payloads and match their indicators against threat intelligence feeds; Beelzebub and behavioral intent recovery add the behavioral profile, the toolchain, objective, and CVEs that line a session up with a known actor even when an AI is driving the attack and the indicators are new. A detonation sandbox that executes rather than simulates does double duty: it analyzes captured payloads, and it survives detection, since an attacker probing the shell with a command that has a known answer like echo $((7*6)) gets the real result instead of a model’s plausible guess. The result is one honeypot that works across many kinds of attack and holds up to the checks meant to expose it.

What’s old is new again

No one has a settled answer for defending against AI attacks. Regulators are setting deadlines, defenders are improvising, and the honest state of the field is ambiguity. While that gets worked out, an old idea is worth reaching for. Honeypots have always worked best against attackers that engage without suspicion, the hand-crafted but naive intruder who takes the bait and keeps going. Today’s AI attackers are exactly that: highly capable, yet eager and naive, driving toward the objective without pausing to ask whether the environment is real. What’s old is new again.

A honeypot only keeps pace if the response does too, so wire it into the defense rather than reading its output by hand. Treat it as the front end of an automated loop: the deception traps and delays the agent on infrastructure we control, while the intent, capability, and indicators it recovers drive the response in parallel, measuring exposure against the recovered playbook, pushing fresh IoCs to detection and blocking, hardening the paths it probed, and rotating any credentials it reveals. Pair that with an agentic SOAR and the loop closes without a human in the critical path, on the attacker’s clock rather than ours. Because it reads behavior instead of injecting the model, it holds that value as models grow more resistant to injection.

The Beelzebub honeypot and our enhancements are open at github.com/setuidloot/lamiai-oss, with a native demo and a full range to run against your own agents. It is a starting point, not a finished product, and the approach needs more testing than one team can give it.

Sources

• Anthropic, Disrupting the first reported AI-orchestrated cyber espionage campaign (November 2025).
• Anthropic, Detecting and countering misuse of AI: August 2025.
• Sysdig Threat Research Team, JADEPUFFER: agentic ransomware for automated database extortion (July 2026); reported by The Hacker News, AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack.
• Google Threat Intelligence Group, GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools (November 2025).
• Noma Security (Sasi Levi), GitLost: How We Tricked GitHub’s AI Agent into Leaking Private Repos (July 2026).
• Reuters, ECB tells banks to draw up plans against AI attacks amid disruption fears (July 2026).
• Veronica Valeros, Muris Sladić, Sebastian Garcia, Ghost Without Shell: Measuring Non-Interactive SSH Attacks on Honeypots (arXiv:2606.28006, 2026).
• Beelzebub Labs, Beelzebub, the open-source LLM honeypot this builds on.