A honeypot routes confirmed web attackers to a copy
A Gingerbread House for LLM Agents: Source-Planned Honeypots That Lure Autonomous Attackers into an Isolated Shadow · arXiv:2611.07611
In plain words
An automated attacker may find a working way into a website while a decoy is trying to distract it. This paper introduces a defence that prepares fake pages and clues in advance, then sends a confirmed attacker to an isolated copy of the site.
In tests with two attack systems, the static defence sharply reduced observed compromises of the real site. In the ARTEX tests, some attacks still worked on the copy while the real site stayed uncompromised in the recorded runs.
The research
A decoy can distract an automated attacker while leaving the vulnerable route open. The practical question is whether the real application can be protected after an attacker has a working exploit, and whether success on a copy should count as a defence doing its job. These results make that distinction visible in the tested tasks.
The paper introduces a static honeypot defence that plans decoys from application source and routes confirmed attackers to an isolated copy, then tests whether it protects the real target.
The static plan was compared with no defence using CVE-Bench, a test of web vulnerabilities whose grader checks task-specific impacts.
On the 40 design tasks, real-target compromise fell from 26 of 40 to 5 of 40 for Claude Opus 4.8; with ARTEX, it fell from 20 of 40 to zero, with 31 valid static-plan runs.
On 20 new tasks, ARTEX compromised the real target in 15 no-defence runs and zero static-plan runs. Grader-confirmed success on the isolated copy in 10 of 15 eligible CVE-Bench tasks supports the interpretation that some working exploits were redirected.
Each task and configuration had one retained run, and the study compared deception with no defence rather than with blocking or detection alone. Tests used selected single-service applications, fixed listener-level client attribution and limited benign traffic.
What the evidence shows
- Route confirmed attackers
The paper introduces a static honeypot defence: it plans decoys from an application’s source and routes a confirmed attacker’s later requests to an isolated copy. This addresses a gap in lures that merely distract an attacker while leaving the vulnerable route open.
The question is whether this routing can protect the real application even after an attacker has a working exploit.
- The design-set result
The grader compares outcomes on the same 40 design tasks, with Claude Opus 4.8 attacking both configurations. The lower real-target compromise count supports protection in this development-set comparison, though one static-plan case exposed the real secret before confirmation.
- Results beyond the design
Seeing the same pattern with ARTEX and on tasks not used to design the plan suggests the result was not confined to Claude Opus 4.8’s design set. These descriptive task counts come from one retained run per task; in the CVE-Bench comparison, the static plan had valid runs for only 31 of 40 tasks.
- Working exploits reached copies
The study separately checked whether attacks worked on the isolated copy. On CVE-Bench, among the 15 tasks ARTEX compromised without defence that had a valid static-plan run, the grader confirmed success on the copy in 10.
Those runs show that at least some attacks were redirected while the real target stayed uncompromised; they do not establish that exploits were equally likely to work with and without deception.
- The extra layer is unclear
The paired comparison does not establish that the added runtime responder improves the static defence. It changes several router rules along with the responder, and the tests found no statistically significant difference between the two configurations.
Deep
- Original paper authors
- Seungdeok Roh, Seokjun Ryu, Sohee Park, Daeseon Choi
- Submitted to arXiv
- License
- arXiv non-exclusive