Paper deep dive

Towards Agentic Honeynet Configuration

Federico Mirra, Matteo Boffa, Idilio Drago, Danilo Giordano, Marco Mellia

Year: 2026Venue: arXiv preprintArea: cs.CRType: PreprintEmbeddings: 38

Intelligence

Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 95%

Last extracted: 3/22/2026, 5:05:25 AM

Summary

The paper introduces an AI-driven agentic architecture for autonomous honeynet configuration. By utilizing an LLM-based agent that analyzes IDS alerts and network state, the system dynamically reconfigures honeypot exposure to track attacker progression and sustain engagement under resource constraints, evaluated via a discrete-state simulation aligned with the MITRE ATT&CK framework.

Entities (5)

Honeypot · system · 100%IDS · security-system · 100%MITRE ATT&CK · framework · 100%LLM-based Agent · software-agent · 98%CVE · vulnerability · 95%

Relation Signals (4)

LLM-based Agent → manages → Honeypot

confidence 98% · autonomously manages honeypot exposure in response to ongoing attacks

LLM-based Agent → analyzes → IDS

confidence 95% · The proposed agent analyses Intrusion Detection System (IDS) alerts and network state

LLM-based Agent → uses → MITRE ATT&CK

confidence 92% · Attacks are modelled as multi-stage processes aligned with the MITRE ATT&CK framework.

Attacker → exploits → CVE

confidence 90% · attackers execute Proof-of-Concept exploits for known CVEs

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Honeypots are deception systems that emulate vulnerable services to collect threat intelligence. While deploying many honeypots increases the opportunity to observe attacker behaviour, in practise network and computational resources limit the number of honeypots that can be exposed. Hence, practitioners must select the assets to deploy, a decision that is typically made statically despite attackers' tactics evolving over time. This work investigates an AI-driven agentic architecture that autonomously manages honeypot exposure in response to ongoing attacks. The proposed agent analyses Intrusion Detection System (IDS) alerts and network state to infer the progression of the attack, identify compromised assets, and predict likely attacker targets. Based on this assessment, the agent dynamically reconfigures the system to maintain attacker engagement while minimizing unnecessary exposure. The approach is evaluated in a simulated environment where attackers execute Proof-of-Concept exploits for known CVEs. Preliminary results indicate that the agent can effectively infer the intent of the attacker and improve the efficiency of exposure under resource constraints

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

37,965 characters extracted from source content.

Expand or collapse full text

Towards Agentic Honeynet Configuration Federico Mirra, Matteo Boffa, Danilo Giordano, Marco Mellia Politecnico di Torino first.last@polito.it Idilio Drago Universit ` a di Torino idilio.drago@unito.it Abstract—Honeypots are deception systems that emulate vul- nerable services to collect threat intelligence. While deploying many honeypots increases the opportunity to observe attacker behaviour, in practise network and computational resources limit the number of honeypots that can be exposed. Hence, practitioners must select the assets to deploy, a decision that is typically made statically despite attacker’ tactics evolving over time. This work investigates an AI-driven agentic architecture that autonomously manages honeypot exposure in response to ongoing attacks. The proposed agent analyses Intrusion Detection System (IDS) alerts and network state to infer the progression of the attack, identify compromised assets, and predict likely attacker targets. Based on this assessment, the agent dynamically reconfigures the system to maintain attacker engagement while minimizing unnecessary exposure. The approach is evaluated in a simulated environment where attackers execute Proof-of-Concept exploits for known CVEs. Preliminary results indicate that the agent can effectively infer the intent of the attacker and improve the efficiency of exposure under resource constraints. Index Terms—Agentic AI, Adaptive Deception Systems. I. INTRODUCTION Defenders face a persistent asymmetry in cybersecurity: attackers continuously adapt their tactics, discover new vul- nerabilities, and exploit weaknesses faster than static defences can evolve. Honeypots – deceptive systems designed to appear vulnerable and attract attacks – play a crucial role by collect- ing threat intelligence and enabling the systematic study of adversarial behaviour [1]. However, defenders operate under finite deployment budgets – limits on computation, bandwidth, or address space – which restrict the number of honeypots that can be instantiated. Decisions about which services to emulate are typically made statically, resulting in suboptimal alignment with the services attackers actively target. Moreover, static honeypots are easier to fingerprint, as sophisticated adversaries can recognize simple static configurations as decoys. Research on darknet monitoring suggests that dynamic environments sustain attacker interest [2], but operationalizing this strategy requires constant analysis of noisy attacker behaviour at scale, which is impractical to perform manually. While recent work has demonstrated that LLMs can gen- erate realistic attacker-facing interactions in honeypots [3]– [6], and that reinforcement learning or game-theoretic methods can optimize honeypot placement [7]–[9], no existing system uses LLM-based reasoning to autonomously manage which services a honeynet exposes over time. In this paper, we present preliminary findings on whether an LLM-based agent can bridge this gap. Figure 1 provides an overview. Attackers possess knowledge of existing vulnerabilities and continuously scan the Internet for systems exposing services aligned with their objectives – knowledge often unavailable to defenders at deployment time. The key challenge is not merely to observe attacks, but to infer which attack surfaces attackers are actively seeking and deliberately expose them. To this end, we propose an agent that analyses IDS and network logs to extract signals of attacker activity, infers likely attacker goals, and dynamically selects a subset of honeypots from a larger pool. By aligning exposed services with inferred objectives, the system promotes engagement and enables informative attacker interactions under strict resource constraints. We evaluate the approach using a discrete-state simulation that models adaptive honeypot deployment under adversar- ial interaction. The simulation instantiates attackers execut- ing proof-of-concept exploits for known CVEs, progressing through a multi-stage exploitation chain aligned with MITRE ATT&CK: discovery, initial access, user-level data exfiltra- tion, privilege escalation, and root-level data exfiltration. The defending agent and attackers act in alternating turns, with the agent exposing at most K services per step. An attacker advances only when the agent exposes a service aligned with its current objective. We consider deterministic, probabilistic, and consecutive attacker persistence models, and evaluate the agent across 81 configurations varying the number of attack- ers, the pool of vulnerable services, and the LLM backend. Our evaluation focuses on the agent’s ability to i) sustain engagement until the attacker completes its chain and i) accurately track attack progression. In sum, we make the following contributions. First, we formalize adaptive honeypot exposure under finite budget as an inference-driven decision-making problem. Second, we introduce a discrete-state simulator for evaluating adaptive honeynet management under multi-stage exploitation and di- verse attacker models. Third, we propose an autonomous LLM-based agent that reasons over IDS logs to infer attacker intent and selects honeypot services accordingly. Finally, we show that LLM-based agents can track attack progression, infer goals, and adapt deployments to improve intelligence collection under resource constraints. Although obtained in a simplified setting, these results provide preliminary evidence that autonomous honeynet management is feasible. 1 1 Data and source code are available at https://github.com/SmartData-Polit o/adaptive-honeynet-agent arXiv:2603.14122v1 [cs.CR] 14 Mar 2026 Attackers (diverse objectives) Monitored System Honeypot pool Scan Expose (Max K) Attack Vulnerabilities Search Generate Logs Interprets Firewall DBSSH WEB FTP VOIP Proposed Agent - Attacker Intention Inference - Honeypot Allocation Policy Fig. 1. Overview of the proposed adaptive honeypot deployment framework. Attackers actively search for specific vulnerabilities and scan the web to identify machines that satisfy their objectives. The proposed agent interprets attack-related logs, infers the attacker’s underlying intentions, and dynamically exposes an optimal subset of honeypots – subject to a maximum budget of K – that best match the attacker’s goals, enabling effective and adaptive deception. I. PROBLEM STATEMENT We formally introduce the problem of adaptive honeypot exposure under finite deployment budget. A defender seeks to maximize the intelligence gained about attacker behaviour under strict resource constraints. In realistic honeynet deploy- ments, limitations in computation, address space, monitoring capacity, and operational risk prevent all vulnerable services from being exposed simultaneously. Hence, only a limited subset of honeypots can be exposed at any given time. In our deployment, we simulate these constraints by allowing the agent to expose only one honeypot at a time, i.e., only a single slot is available to attract attacker interactions. • System Model: Let H = h 1 , h 2 , . . . , h N denote the set of candidate honeypot services, where each h i emulates a specific vulnerable application or configuration (e.g., a known CVE). Time progresses in discrete decision epochs t = 1, 2, . . . , each corresponding to a control checkpoint at which the defender aggregates recent observations (e.g., IDS alerts and network logs) and may update the exposed services. At each epoch, the defender can expose at most K ≪ N services, reflecting a fixed deployment budget. Attackers interact with the honeynet by scanning for ex- posed services and attempting exploits aligned with their objectives. We assume attacker behaviour follows a struc- tured, multi-stage intrusion process consistent with the MITRE ATT&CK framework, progressing through ordered phases such as reconnaissance, initial access, post-exploitation, privi- lege escalation, and data exfiltration. The progression to later stages depends on the availability of services aligned with the current objective of the attacker. • Partial Observability and Intent Inference: The internal state of the attacker, including goals, progress along the intrusion chain, and future plans, is not directly observable. Instead, the defender observes partial and noisy signals de- rived from network telemetry and intrusion detection systems (IDS), such as alerts, signatures, and protocol-level indicators. These observations may be incomplete, ambiguous, delayed, or affected by false positives. Consequently, the defender must infer the attacker’s latent state from the accumulated evidence, mapping low-level in- dicators to a higher-level understanding of the progression and intent of the attack. This inference problem is inherently temporal as the interpretation of new observations depends on previously observed activity. • Aggregation of Concurrent Attack Activity: In practice, honeynets are subjected to high-volume continuous traffic from multiple independent sources. Scanning, prob- ing, and exploitation attempts from different attackers may overlap in time and interleave between services, generating heterogeneous IDS alerts. Precisely attributing each event to a different attacker or campaign is often infeasible. In this work, we assume that raw network and IDS data are pre- aggregated over each decision epoch, and that the agent receives a consolidated stream of attack-related observations reflecting concurrent malicious activity. The agent does not attempt to disentangle individual attackers. Instead, it reasons over a single aggregated attack process, inferring a dominant or representative attack progression that reflects the objectives currently exercised against the honeynet. This abstraction aggregates multiple concurrent attackers into a single semantic “thread of attack” capturing common exploitation patterns, targeted services, and stages of intrusion. In our experimental evaluation, this aggregated attack pro- cess is instantiated by simulating a single attacker at a time, which serves as an equivalent representative of the concurrent attack flow described above. This modelling choice aligns with the defender’s objective in a honeypot setting: not precise attacker attribution, but identification of the attack surfaces that are actively targeted and their current stages of exploitation. From the perspective of adaptive honeypot exposure, multi- ple attackers pursuing similar vulnerabilities exert equivalent pressure on the deployment and motivate the same exposure decisions. • Decision Problem: At each decision epoch t, the defender selects a subset E t ⊆ H with |E t | ≤ K to expose. Exposing services aligned with attacker objectives enables continued progression and reveals additional behaviour, while exposing irrelevant services may delay the attack or cause disengagement. The defender’s objective is not to prevent com- promise, but to maximize intelligence collection by sustaining engagement under minimal and targeted exposure, inducing a trade-off between exploration and exploitation. • Problem Formulation: We formalize adaptive honeypot exposure as an inference-driven sequential decision-making problem under partial observability. At each decision epoch, the defender observes an accumulated stream of network and intrusion-detection events, reflecting both repeated interactions by the same attacker and overlapping activity from multiple attackers. These observations are inherently noisy and indirect, as they do not explicitly encode the current stage or intent of the attacker. Given this history, the defender must: 1) Infer the latent stage of the ongoing attack process and the likely adversarial objectives from the aggregated partial evidence. 2) Select a budget-constrained subset of services to expose in order to maximize expected future information gain. This problem is characterized by three key challenges: (i) intent inference from low-level and temporally aggregated security telemetry, (i) budget-constrained adaptation of the exposed attack surface under uncertainty, and (i) temporal consistency, as premature hiding or delayed exposure of ser- vices can disrupt attack progression. Manually configured honeypots cannot address these chal- lenges, motivating autonomous agents capable of maintaining beliefs about attack progression, reasoning over accumulated evidence, and dynamically reshaping the honeynet. I. ADAPTIVE HONEYNET MANAGEMENT AGENT We propose an autonomous agent for adaptive honeypot deployment that continuously observes attacker activity, infers adversarial intent, and dynamically adjusts the exposed attack surface under a finite deployment budget. The agent follows a perception–inference–action loop, with a large language model (LLM) acting as the central reasoning component. By ab- stracting low-level network telemetry into semantically mean- ingful signals and enforcing decisions through programmable network controls, the system enables closed-loop adaptation without human intervention. A. Design Principles The architecture is guided by three key principles. • Evidence-driven reasoning: All inferences are grounded in observable network evidence. Instead of processing raw packet traces, which would saturate the LLM’s context, the agent consumes structured alerts produced by an intrusion de- tection system (IDS). This ensures scalability while preserving the semantics of the attack. • Temporal consistency: Attacks are modelled as multi- stage processes aligned with the MITRE ATT&CK framework. The agent reasons over accumulated, partial, and noisy obser- vations – gathered from repeated interactions and overlapping attack activity – to infer the attacker’s latent current stage and anticipate likely subsequent objectives, maintaining coherent exposure decisions over time. • Controlled actuation: Adaptation is constrained by an explicit exposure budget K, which limits the number of simul- taneously exposed honeypots. Exposure decisions are enforced through deterministic network reconfiguration (e.g., firewall rules), ensuring precise, auditable, and reversible actions. B. Agent Architecture The agent operates as a recurring control loop of four logical components (orange and blue boxes of Figure 2). • A perception layer periodically collects IDS alerts, honeypot metadata, and the current state of network exposure. IDS alerts compact high-volume traffic into discrete events such as scans, exploit attempts, or post-exploitation activity, making them suitable for semantic analysis. • An attack inference layer uses the LLM to interpret newly observed alerts in the context of previous observations. This step infers the progression of the attacker through a multi-stage exploitation chain, producing an evolving internal representation that captures the attack phases, the targeted services, and the estimated depth of exploitation. • An exposure planning layer also uses the LLM to select a subset of honeypots to expose during the next decision epoch, subject to budget constraints K. The planner prioritizes services aligned with the inferred attacker objective while minimizing unnecessary exposure of unrelated assets. • An enforcement and memory layer translates exposure decisions into concrete network actions (e.g., firewall updates) and records observations, inferences, and actions in episodic memory. This memory provides a short-term context for subsequent reasoning and supports post-hoc analysis. C. LLM-Centered Reasoning The LLM serves as the central reasoning component of the agent: it interprets observed attacker activity and selects ap- propriate exposure actions. Rather than applying a simple rule- based approach, the model grounds its decisions on contextual information accumulated across multiple iterations. At each decision step, the LLM is provided with (i) summarised IDS alerts from the current epoch, (i) the previously inferred attack progression, and (i) the deployment constraints imposed by the exposure budget. The inferred attack progression is represented as an attack graph, where nodes correspond to attack stages or compromised services, and edges represent plausible transitions induced by attacker actions. Each attacker interaction contributes evidence for one or more edges in this graph, potentially extending existing branches or activating new ones. The agent does not observe this graph directly; instead, the LLM incrementally infers and updates its structure by reasoning over accumulated alerts, effectively reconstruct- ing which objectives are being pursued and along which exploitation paths. Based on the updated attack graph, the LLM refines the inferred attack state and determines which honeypot services should be exposed next. Notice that, as the reasoning logic is encapsulated in the LLM, the same architecture can be instantiated with a different Perception Layer Enforcement LayerExit (p) Launch Exploit (1-p) Quit Terminate IDS Data Collection Attack Outcome Exposure Layer Inference Layer Exposure Policies Attackers Proposed Agent Exit Fig. 2. Discrete-time simulation of attacker–defender interaction. The system evolves in epochs alternating between attacker actions and agent decisions, where the agent infers attack progression from IDS data and applies budget-constrained exposure policies. model backend, enabling direct evaluation of how model capacity affects the agent’s capabilities. To summarise, the key architectural insight we propose is the separation between semantic reasoning – comprising attack inference and exposure planning, handled by the LLM – and deterministic control – comprising perception, enforce- ment, and memory, implemented via conventional networking mechanisms. This separation enables autonomous, adaptive honeynet management while preserving safety, traceability, and strict control over resource usage. IV. SIMULATION ENVIRONMENT To evaluate the proposed adaptive honeypot management agent in a controlled, yet adversarial setting, we design a discrete-time simulation that models repeated interactions be- tween attackers and a resource-constrained defender. The sim- ulation captures the temporal dynamics of multi-stage intru- sions and allows systematic evaluation of inference accuracy and exposure efficiency under varying attacker behaviours. • Discrete-Time Interaction Model: The simulation proceeds in discrete epochs, each consisting of an attacker phase followed by a defender decision phase, as illustrated in Figure 2. At every epoch, the defending agent may expose at most K honeypot services selected from a larger pool of candidates. By restricting the number of concurrently exposed honeypots (only one exposed honeypot in our scenario), the simulation models realistic operational constraints that forces the agent to dynamically adapt its deception strategy rather than relying on a static, fully exposed attack surface. During the attacker phase, an adversary scans the currently exposed services and decides whether to interact with them based on their objectives and persistence strategy. In the defender phase, the agent analyses the resulting network and IDS logs, updates its internal representation of the attack progression, and selects the honeypots to expose in the next epoch. We simulate a queue of A attackers, that subsequently interacts in the simulation. • Attack Progression Model: We model attacker be- haviour as a multi-stage exploitation chain aligned with the MITRE ATT&CK framework. Attackers progress through an ordered sequence of phases – reconnaissance (service scanning), initial access, user-level data exfiltration, privilege escalation, and root-level data exfiltration – but may terminate the attack upon achieving an intermediate objective (e.g., stopping after user-level exfiltration rather than pursuing full root compromise). The progression to a subsequent phase occurs only when the defender exposes a honeypot service aligned with the attacker’s current objective, directly coupling attacker evolution with exposure decisions. This formulation enables evaluation of whether the agent can infer attacker intent from observations and adapt the exposed attack surface to sustain engagement. The simulator records the progression of the attacker in the ground-truth, which is used to assess the accuracy of the agent’s inferred attack state. • Attacker Persistence Models: To capture various ad- versarial behaviours, the simulator instantiates multiple persis- tence strategies of attackers. We consider: (i) deterministic at- tackers, which always attempt exploitation whenever a relevant service is exposed (p = 1); (i) consecutive attackers, which require the same service to remain exposed across consecutive epochs to progress (p = 1 if the correct service is exposed, p = 0 otherwise); and (i) probabilistic attackers, whose likelihood of continuing an attack decreases when exposure is intermittent. More formally, if g is the number of non-exposure epochs, we compute p as: p = ( 1,if g ≤ 0 max(p min , 1− d· g), if g > 0 Where d and p min are hyper-parameters representing a decay factor per-epoch and the minimum attempt probability floor. • Observations and Termination: All attacker actions generate synthetic network traces and IDS alerts, which con- stitute the sole observations available to the defending agent. The agent does not have direct access to the attacker’s internal state or the progression of the ground-truth. A simulation run ends when the agent has processed all attackers. This means, for each attacker, either i) by determining that the inferred attack chain is exhausted, i) by the attacker abandoning the interaction, or i) when reaching a predefined epoch limit. V. EVALUATION RESULTS We now describe the experimental setup and present the results of the agents for the proposed simulations. A. Experimental Settings Honeynet configurations: We consider three simulated scenarios that progressively increase both the ambiguity of the attack-surface and the diversity of attacker objectives. Let A denote the pool of attackers, H the pool of available machines, and K the number of vulnerable machines that can be deployed per epoch. Throughout the experiments, we fix K = 1 and define the following configurations: 1) Fully vulnerable deployment. A = 4 attackers and H = 4 machines, all of which are vulnerable. This represents the simplest setting, as any machine exposed by the agent can satisfy the objective of an attacker. 192.168.100.2 172.20.0.10 172.20.0.10 172.20.0.10 172.20.0.10 172.20.0.10 172.20.0.3 172.20.0.3 172.20.0.3 172.20.0.3 172.20.0.2 172.20.0.2 172.20.0.2 172.20.0.7 172.20.0.7 172.20.0.7 172.20.0.7 172.20.0.7 172.20.0.4172.20.0.5172.20.0.30172.20.0.8 scan init-acc user data-exf privil-esc root data-exf scan init-acc privil-esc root data-exf scan init-acc user data-exf scan init-acc user data-exf privil-esc root data-exf scan scan scan scan Services Attacker Gitlab Apache Struts Docker API Xdebug Decoy Fig. 3. Ground-truth attack graph used in the simulation. Nodes represent attack stages and services, and edges encode feasible progression paths aligned with the MITRE ATT&CK framework. 2) Small mixed deployment. A = 2 attackers and H = 4 machines, comprising two vulnerable machines and two non-exploitable ones. This setting is more challenging, as the agent must infer that some exposed machines are irrelevant to the attacker. 3) Large mixed deployment. A = 2 attackers operate over H = 6 machines, including two vulnerable ma- chines and four non-exploitable ones. This is the most challenging scenario, as only a small subset of available honeypots is relevant to the attacker’s objectives. As |H| increases while the number of vulnerable machines remains fixed, the agent must infer the intent of the attacker from an increasingly large and noisy set of candidates. Attackers and language models: To simulate realistic adversarial behavior, attackers execute scripted multi-stage exploits derived from public proof-of-concept attacks. These specific attack chains target vulnerabilities in GitLab, Apache Struts, Docker API, and Xdebug, progressing through distinct phases from Initial Access to Root Data Exfiltration. We represent the ground-truth attack graph in Figure 3. As described in Section IV, we evaluate three persistence strategies of attackers. For probabilistic attackers, we set d = 0.25 and p min = 0.1. To assess the impact of reasoning capacity on inference and exposure control, we evaluate three language-model back- ends: GPT-4.1, GPT-4.1-mini, and gpt-oss-120b. The first two are accessed via the OpenAI API, whereas gpt-oss-120b is deployed locally. While fine-tuning gpt-oss-120b could potentially improve performance while retaining the advantages of a smaller self-hosted model, this lies outside the scope of the present work; therefore, all models are evaluated in their off-the-shelf configuration. In the sake of space, we provide a more detailed description of the vulnerable environments, prompt templates, model configurations, and examples of generated IDS alerts in our GitHub repository. Evaluation protocol: Simulations proceed in discrete time with a maximum horizon of 20 epochs. We evaluate the agent’s capability to gather intelligence along two complementary dimensions: • Exploitation Achieved: A binary metric that indicates whether agent exposure decisions allow the attacker to reach the terminal node of the ground-truth attack graph. • Attack-Stage Inference Score: At each epoch, the agent predicts the current stage of the attacker in the attack graph. During an episode, we compute true positives (TP), false negatives (FN), and false positives (FP) based on agreement with the ground-truth progression and com- pute score = T P T P+F P+F N . To ensure comparability across scenarios, metrics are com- puted for the two attackers present in all configurations (GitLab and Apache Struts of Figure 3). Each configuration is repeated over three random seeds, resulting in 81 runs in total (3 language models × 3 honeynet configurations × 3 persistence strategies × 3 seeds). B. Results Exploitation vs. deployment setting: Table I reports ex- ploitation achieved across models and honeynet configurations, with each entry aggregating 9 runs. In the fully vulnerable setting, all models achieve a 100% success rate, confirming that in the absence of attack-surface ambiguity, the agent reliably sustains attacker progression. As non-exploitable decoys are introduced, exploitation be- comes progressively more difficult. In the small mixed con- figuration, success rates decrease across all models, indicating that even limited ambiguity challenges exposure control. This effect is amplified in the large mixed configuration, where the proportion of relevant machines is lowest and the exploitation success drops substantially, particularly for GPT-4.1-mini. In general, these results highlight the central role of attack- surface ambiguity in hindering sustained attacker progression. TABLE I EXPLOITATION SUCCESS RATES – LLM VS DEPLOYMENT SETTINGS. ModelDeployment settingExploitation achieved GPT-4.1 Fully vulnerable9/9 (100%) Small mixed7/9 (78%) Large mixed6/9 (67%) GPT-4.1-mini Fully vulnerable9/9 (100%) Small mixed8/9 (89%) Large mixed4/9 (44%) gpt-oss-120b Fully vulnerable9/9 (100%) Small mixed8/9 (89%) Large mixed8/9 (89%) Notably, gpt-oss-120b appears to outperform larger models in mixed deployments. As discussed in the following, this apparent advantage is misleading, as the success of the exploitation alone does not reflect the accuracy of the agent’s internal estimate of the attacker’s progression. Exploitation vs. attacker persistence: Table I reports the exploitation achieved as a function of attacker persistence, aggregating the results over deployment settings. Deterministic attackers are the easiest to maintain and yield consistently high exploitation rates across models. Probabilistic attack- ers introduce additional uncertainty, resulting in moderate performance degradation. The most challenging setting is the consecutive persistence model, which requires uninter- rupted correct exposure decisions. In this regime, the success of the exploitation decreases markedly for GPT-4.1 and GPT-4.1-mini, indicating the sensitivity to compounding inference errors. In contrast, gpt-oss-120b achieves per- fect exploitation in this setting. However, a closer inspection reveals that this performance arises from a systematic bias in how the model interprets attacker progression. While the agent prompt requires mapping IDS evidence to a sequence of attack stages – from reconnaissance to root-level data exfiltration – gpt-oss-120b frequently predicts early reconnaissance and final exfiltration stages while largely ignoring intermediate phases. As a result, the agent exposes machines as if the attacker were near completion, even when the attacker is still progressing through earlier stages, inadvertently facilitating exploitation despite inaccurate internal state estimation. TABLE I EXPLOITATION SUCCESS RATES – LLM VS PERSISTENCE MODELS. ModelAttacker modeExploitation achieved GPT-4.1 Deterministic9/9 (100%) Probabilistic7/9 (78%) Consecutive6/9 (67%) GPT-4.1-mini Deterministic8/9 (89%) Probabilistic8/9 (89%) Consecutive5/9 (56%) gpt-oss-120b Deterministic8/9 (89%) Probabilistic8/9 (89%) Consecutive9/9 (100%) Attack inference accuracy: Finally, Table I reports the attack-stage inference score in models, deployment settings, and persistence strategies. In contrast to exploitation success, the inference score degrades consistently as the ambiguity of the attack-surface increases. All models perform best in the fully vulnerable setting, with the score decreasing in the small mixed configuration and further dropping in the large mixed scenario. Across all conditions, GPT-4.1 achieves the highest inference score, followed by GPT-4.1-mini, while gpt-oss-120b consistently lags behind. This holds even in scenarios where gpt-oss-120b exhibits strong exploitation performance. By prematurely hallucinating evidence from the terminal-stage without correctly tracking intermediate attack phases, gpt-oss-120b can sustain attacker progression while failing to accurately estimate the attacker’s true position in the ground-truth attack graph. In contrast, GPT-4.1 and GPT-4.1-mini exhibit more fine-grained phase tracking, improving the score at the cost of increased sensitivity to exposure errors under high ambiguity. These results demon- strate that exploitation success alone can be misleading and underscore the importance of jointly evaluating deception effectiveness and attack-stage inference fidelity. TABLE I ATTACK-STAGE INFERENCE SCORE ACROSS LLMS AND DEPLOYMENT SETTINGS. WE AGGREGATED RESULTS OVER RANDOM SEEDS. DeploymentAttack modeGPT-4.1GPT-4.1-minigpt-oss-120b Fully vuln. Deterministic85.9± 4.285.2± 10.555.6± 0.0 Probabilistic88.9± 0.077.8± 0.059.3± 5.2 Consecutive88.9± 0.070.4± 5.251.9± 5.2 Small mix. Deterministic83.0± 4.277.8± 0.059.3± 5.2 Probabilistic81.5± 10.574.1± 5.250.0± 4.5 Consecutive81.5± 10.574.1± 13.955.6± 0.0 Large mix. Deterministic83.0± 4.277.8± 9.155.6± 0.0 Probabilistic81.5± 10.574.1± 13.955.6± 0.0 Consecutive74.1± 10.563.0± 5.259.3± 5.2 VI. CONCLUSIONS In this paper, we study whether an LLM-driven agent can autonomously adapt honeypot exposure under strict resource constraints by inferring attacker intent from partial security telemetry. We formulate adaptive honeypot deployment as a sequential inference problem and evaluate the approach using a discrete-time simulator modeling multi-stage attacks aligned with the MITRE ATT&CK framework. Our results show that LLM-based agents can infer attacker progression and select which services to expose to sustain en- gagement. Performance degrades as attack-surface ambiguity increases, but stronger language models achieve higher attack- stage inference accuracy, indicating that semantic reasoning over IDS alerts can capture attacker objectives despite partial observability. We further observe that exploitation success alone can be misleading: attackers may progress even when the agent’s internal estimate of the attack state is inaccurate. This highlights the need to jointly evaluate engagement and inference accuracy when assessing adaptive deception systems. This work is preliminary and relies on scripted attackers and simplified abstractions of concurrent activity. Ongoing work focuses on validating the architecture in a live honeynet, extending the inference model to handle multiple concurrent attack hypotheses, and assessing whether fine-tuned local LLM models can achieve performance comparable to larger models. Overall, these results provide initial evidence that agentic AI can act as a viable control plane for adaptive cyber deception under realistic constraints. REFERENCES [1] X. Han, N. Kheir, and D. Balzarotti, “Deception techniques in computer security: A research perspective,” ACM Computing Surveys (CSUR), vol. 51, no. 4, p. 1–36, 2018. [2] F. Soro, T. Favale, D. Giordano, I. Drago, T. Rescio, M. Mellia, Z. B. Houidi, and D. Rossi, “Enlightening the darknets: Augmenting darknet visibility with active probes,” IEEE Transactions on Network and Service Management, vol. 20, no. 4, p. 5012–5025, 2023. [3] M. Sladi ́ c, V. Valeros, C. Catania, and S. Garcia, “Llm in the shell: Generative honeypots,” in 2024 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW). IEEE, 2024, p. 430–435. [4] Z. Wang, J. You, H. Wang, T. Yuan, S. Lv, Y. Wang, and L. Sun, “Honeygpt: breaking the trilemma in terminal honeypots with large language model,” arXiv preprint arXiv:2406.01882, 2024. [5] H. T. Otal and M. A. Canbaz, “Llm honeypot: Leveraging large language models as advanced interactive honeypot systems,” in 2024 IEEE Con- ference on Communications and Network Security (CNS). IEEE, 2024, p. 1–6. [6] C. Vasilatos, D. J. Mahboobeh, H. Lamri, M. Alam, and M. Maniatakos, “Llmpot: Dynamically configured llm-based honeypot for industrial pro- tocol and physical process emulation,” in 2025 IEEE 10th European Symposium on Security and Privacy (EuroS&P). IEEE, 2025, p. 963– 979. [7] A. H. Anwar, C. A. Kamhoua, N. O. Leslie, and C. Kiekintveld, “Honey- pot allocation for cyber deception under uncertainty,” IEEE Transactions on Network and Service Management, vol. 19, no. 3, p. 3438–3452, 2022. [8] L. Huang and Q. Zhu, “Adaptive honeypot engagement through rein- forcement learning of semi-markov decision processes,” in International conference on decision and game theory for security.Springer, 2019, p. 196–216. [9] C. Guan, H. Liu, G. Cao, S. Zhu, and T. La Porta, “Honeyiot: Adaptive high-interaction honeypot for iot devices through reinforcement learning,” in Proceedings of the 16th ACM Conference on Security and Privacy in Wireless and Mobile Networks, 2023, p. 49–59. APPENDIX A. Deployed Services and Attack Phases This appendix describes the vulnerable services exposed in our simulated honeynet and summarizes the corresponding 2) Apache Struts: CVE-2018-11776 is a remote code ex- ecution vulnerability affecting Apache Struts. The attack se- quence begins with identifying a Struts-based web application, followed by directory traversal and endpoint enumeration to locate vulnerable paths, and culminates in the execution of the exploit payload. This exploitation chain illustrates the risks associated with legacy enterprise web frameworks, where a single vulnerable endpoint can lead to full system compro- mise due to insufficient input validation and insecure default configurations. 3) GitLab: CVE-2021-22205 affects GitLab CE/E ver- sions starting from 11.9 and enables unauthenticated remote code execution due to improper validation of image files passed to a file parser. Once initial access is obtained, an attacker may exfiltrate sensitive data and escalate privileges, potentially resulting in full compromise of the GitLab instance. Given GitLab’s central role in managing source code reposito- ries and CI/CD pipelines, this attack highlights the amplified impact of compromise in DevOps environments. exploitation chains implemented by the attacking proof-of- concept (POC) exploits. 1) Docker: An exposed Docker daemon API can enable remote code execution (RCE) when unauthenticated access to the API is permitted. In this case, an attacker may execute arbitrary container commands, spawn privileged containers, and obtain root-level access on the host. Since Docker contain- ers often run with elevated privileges or direct access to host resources, successful exploitation of the Docker API typically results in full host compromise, making this attack vector particularly severe in cloud and containerized environments. 4) Xdebug: This attack models a common exploitation sequence against the PHP debugging extension Xdebug when remote debugging is misconfigured and exposed in production environments. An unauthenticated HTTP request triggers the DBGp debugging session, causing the server to connect back to the attacker, who can then issue debug commands to execute arbitrary PHP code. From this foothold, the attacker may perform data exfiltration, escalate privileges (depending on web-server permissions), and ultimately compromise the host system. Because Xdebug is intended for development use, its presence in production systems often indicates poor deployment hygiene and significantly increases attack surface exposure. Table IV summarizes the exploitation phases implemented for each deployed service in our simulation. Service Scan Initial Access Data Exfil Priv. Esc. Root Exfil GitLab✓ Xdebug✓ Apache Struts✓✗✓ Docker API✓✗ Others✓✗ TABLE IV IMPLEMENTED ATTACK PHASES PER DEPLOYED SERVICE. GREEN CHECKMARKS INDICATE SUPPORTED PHASES, WHILE RED DASHES DENOTE PHASES THAT ARE NOT MODELED

Instant research discovery