Large language model serving stacks, commercial inference APIs, vector databases, and agent orchestration gateways are now ex- posed on the public internet and indexed by commodity scanners within hours of deployment. The threat characteristics of this sur- face are only beginning to be measured, and the honeypot frame- works that could measure it were designed for conventional net- work services rather than for AI infrastructure. In fact, emulating an AI service is a distinct deception problem: the observable behavior of the service, including model inventories, token formats, tool-call protocols, and authorization flows, must be reproduced faithfully, while the underlying computation, model inference and tool ex- ecution, must never occur. We present InferD, a low-interaction honeypot framework organized around a single principle we call deception without inference: every request an adversary can observe is answered from static response pools, and nothing an adversary submits is ever executed. InferD decomposes the emulation into four deception planes, transport, service protocol, vulnerability surface, and agentic session, adds a provenance plane that links a planted credential to evidence of downstream model-mediated processing.
Figures & tables
Figure 1. InferD capture path. All requests traverse common middleware and a per-service emulator before reaching an append-only log, inside a kernel-level egress boundary Architecture of InferD. Internet probes reach either Surface 1, containing directly exposed self-hosted AI services, or Surface 2, containing TLS-fronted cloud API facades. Both paths pass through common middleware and a per-service emulator before being recorded in the canonical event log. The complete capture path is protected by a kernel-enforced outbound-traffic boundary.
Service
Port / path
Primary capture
Surface 1: self-hosted, open ports
Ollama
11434
Model enumeration and pull, generation probes
vLLM
8001
Completions deserialization and multimodal RCE payloads
Supply-chain compromise occurs before network contact; not observable by passive inbound capture
✗
MCP05 Command injection & execution
Command execution payloads captured via structural anomaly scan; demonstrated by the LiteLLM case study (Section 5.2 )
✓
MCP06 Intent flow subversion
Full tool-call sequences and arguments per session
✓
Table 2. InferD coverage of the OWASP MCP Top 10 (beta, MCP01:2025–MCP10:2025). ✓ observed in inbound traffic; ✗ outside passive scope; ~ partially observable; † covered as a capability, not an observed attack.
Quantity
Value
Observation window
Eight weeks (May-July 2026)
Total requests recorded
24,192
Distinct source addresses
2,342
Source countries / source ASNs
61/ 254
Single-request sources
71%
Two most common request types (model list, root)
64%of requests
Table 3. Deployment window data statistics
Figure 2. Daily request volume over the deployment window Line chart showing the number of requests received per day during the eight-week deployment from May to July 2026. Traffic shows a generally low, slowly rising baseline interrupted by several short bursts of substantially higher request volume.
Figure 3. Distribution of models requested at the Ollama facade during the study window Horizontal bar chart showing model-pull and inference requests observed at the Ollama facade. Llama 3.x variants account for the largest shares, followed by requests for Mistral, DeepSeek-R1, Phi, Gemma, and Qwen variants.
Figure 4. MCP stdio as a code-execution primitive and InferD’s interception. Solid arrows show the observed interaction, while dashed gray elements show the prevented execution path. InferD intercepts the request and returns a static response; the process spawn (step 2) and subsequent credential-access stages (3–4) therefore never execute. Kernel egress filtering provides an additional backstop for the cloud-access paths (3b, 3c). Sequence diagram involving an attacker, the LiteLLM gateway emulated by InferD, and the host operating system and cloud environment. The observed request sends a Python command with a base64-encoded payload to the test-connection endpoint. InferD detects and logs the payload and returns a static tools-list response. A dashed prevented path shows the subprocess spawn, local and cloud credential access, secret-manager access, and credential insertion that would have occurred on a vulnerable real service but do not execute in InferD.
Characteristic
Variant A
Variant B
SHA-256 prefix (decoded)
ef111d4b
c1dfa178
Decoded size (bytes)
57,414
66,176
Sequence similarity to Variant A
baseline
0.929
Azure IMDS module
absent
present
Kubernetes API enumeration
absent
present
Source ASN
AS37693 (Tunisia)
AS14061 (Germany)
Table 4. Characteristics of the two credential-harvester payload builds captured from the LiteLLM facade. Sequence similarity is computed over decoded source content.
Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.