Honeypots are deception systems that emulate vulnerable services to collect threat intelligence. While deploying many honeypots increases the opportunity to observe attacker behaviour, in practise network and computational resources limit the number of honeypots that can be exposed. Hence, practitioners must select the assets to deploy, a decision that is typically made statically despite attackers' tactics evolving over time. This work investigates an AI-driven agentic architecture that autonomously manages honeypot exposure in response to ongoing attacks. The proposed agent analyses Intrusion Detection System (IDS) alerts and network state to infer the progression of the attack, identify compromised assets, and predict likely attacker targets. Based on this assessment, the agent dynamically reconfigures the system to maintain attacker engagement while minimizing unnecessary exposure. The approach is evaluated in a simulated environment where attackers execute Proof-of-Concept exploits for known CVEs. Preliminary results indicate that the agent can effectively infer the intent of the attacker and improve the efficiency of exposure under resource constraints
Figures & tables
Fig. 1: Overview of the proposed adaptive honeypot deployment framework. Attackers actively search for specific vulnerabilities and scan the web to identify machines that satisfy their objectives. The proposed agent interprets attack-related logs, infers the attacker’s underlying intentions, and dynamically exposes an optimal subset of honeypots – subject to a maximum budget of K – that best match the attacker’s goals, enabling effective and adaptive deception.
Fig. 2: Discrete-time simulation of attacker–defender interaction. The system evolves in epochs alternating between attacker actions and agent decisions, where the agent infers attack progression from IDS data and applies budget-constrained exposure policies.
Fig. 3: Ground-truth attack graph used in the simulation. Nodes represent attack stages and services, and edges encode feasible progression paths aligned with the MITRE ATT&CK framework.
Model
Deployment setting
Exploitation achieved
GPT-4.1
Fully vulnerable
9/9 (100%)
Small mixed
7/9 (78%)
Large mixed
6/9 (67%)
GPT-4.1-mini
Fully vulnerable
9/9 (100%)
Small mixed
8/9 (89%)
Large mixed
4/9 (44%)
TABLE I: Exploitation success rates – LLM vs deployment settings.
Model
Attacker mode
Exploitation achieved
GPT-4.1
Deterministic
9/9 (100%)
Probabilistic
7/9 (78%)
Consecutive
6/9 (67%)
GPT-4.1-mini
Deterministic
8/9 (89%)
Probabilistic
8/9 (89%)
Consecutive
5/9 (56%)
TABLE II: Exploitation success rates – LLM vs persistence models.
Deployment
Attack mode
GPT-4.1
GPT-4.1-mini
gpt-oss-120b
Fully vuln.
Deterministic
85.9 ± 4.2
85.2 ± 10.5
55.6 ± 0.0
Probabilistic
88.9 ± 0.0
77.8 ± 0.0
59.3 ± 5.2
Consecutive
88.9 ± 0.0
70.4 ± 5.2
51.9 ± 5.2
Small mix.
Deterministic
83.0 ± 4.2
77.8 ± 0.0
59.3 ± 5.2
Probabilistic
81.5 ± 10.5
74.1 ± 5.2
50.0 ± 4.5
Consecutive
81.5 ± 10.5
74.1 ± 13.9
55.6 ± 0.0
TABLE III: Attack-Stage Inference Score across LLMs and deployment settings. We aggregated results over random seeds.
Service
Scan
Initial Access
Data Exfil
Priv. Esc.
Root Exfil
GitLab
✓
✓
✓
✓
✓
Xdebug
✓
✓
✓
✓
✓
Apache Struts
✓
✓
✗
✓
✓
Docker API
✓
✓
✓
✗
✗
Others
✓
✗
✗
✗
✗
TABLE IV: Implemented attack phases per deployed service. Green checkmarks indicate supported phases, while red dashes denote phases that are not modeled