AgentSnare: Learning to Delay, Divert, and Defuse Autonomous Penetration Agents Ruoyu Wang1∗ , Heng Zhao2∗ , Renjie Wu3 , Mengnan Zhao4 , Zhixuan Chu2 , Wanyu Lin5 , Tianhang Zheng6 1
The University of Hong Kong 2 Zhejiang University 3 Hainan University 4 Anhui University 5 The Hong Kong Polytechnic University 6 The State Key Laboratory of Blockchain and Data Security, Zhejiang University
Introduction Recent advances in large language models (LLMs) have enabled autonomous penetration-testing agents that plan attacks, invoke tools, interpret execution results, and continually revise their strategies (Deng et al. 2024; Zhu et al. 2025). Although these agents can improve legitimate security testing, they can also be used for malicious cyberattacks (Ayzenshteyn, Weiss, and Mirsky 2025). Unlike traditional penetration-testing methods following fixed workflows, an autonomous penetration agent can adapt and determine its next action by analyzing its observations from the environment. This dependence on environmental observations creates a defensive opportunity against malicious agents: de∗
These authors contributed equally.
0.5
DeepSeek V4 Pro
0.10
0.25
0.10
0.05
0.15
0.25
GPT-4o
0.15
0.30
0.15
0.10
0.25
0.40
Gemini 3.1 Pro
0.10
0.20
0.10
0.10
0.15
0.25
0.3
Claude Sonnet 4.6
0.05
0.15
0.05
0.05
0.10
0.20
0.2
MiniMax M2.7
0.10
0.25
0.10
0.10
0.20
0.35
Kimi K2.6
0.05
0.25
0.10
0.05
0.20
0.30
c. es ion ion tion tion Exe Lur ent upt ula cep Att orr ode zed nip i t Per C l C a r a l d e a ci de ced le M Div isle Spe Mo Ro For
0.4
0.1
Defense effectiveness
Large language model (LLM) agents automate penetration testing through an observation–action loop, selecting actions based on observations returned by tools. This dependence allows defenders to inject deceptive observations that can mislead the agent’s decision-making process. However, existing defenses rely heavily on static, isolated artifacts planted in the environment prior to an attack. Advanced agents can progressively recognize and bypass these artifacts, ultimately refocusing their exploitation attempts on the real target. To address this issue, we introduce AgentSnare, a trajectory-adaptive deception system that dynamically unfolds a decoy environment to continually steer the penetration agent away from the real target. Specifically, AgentSnare employs an artifactconstruction policy model that constructs candidate artifacts conditioned on the agent’s interaction history and decoy state. AgentSnare then validates these candidates and incrementally incorporates valid artifacts into a factually consistent decoy environment, thereby delaying the attack by absorbing its tool calls, diverting its post-entry trajectory within the decoy, and defusing it by inducing completion reports grounded in decoy evidence. Across 15 CVE-Bench web applications and three attacker models, AgentSnare absorbs 46.8% of the agent’s tool calls in the decoy and retains 55.9% of post-entry actions there, while 90.0% of completion attempts are grounded in decoy evidence; across all 45 attacker–CVE pairs, no real target is successfully exploited at pass@3.
Attacker LLM
arXiv:2607.26998v1 [cs.CR] 29 Jul 2026
Abstract
0.0
M
Figure 1: Interference@20 of 13 static intervention instances across six attacker LLMs and six tactics. Higher values indicate stronger interference.
fenders can deliberately manipulate the observations to mislead the agent’s decision-making process. Existing defenses against LLM-based penetration agents mainly rely on static tactics, which introduce deceptive artifacts such as honeytokens, misleading files, prompt injections and compute-wasting lures, into the environment before the penetration (Ayzenshteyn, Weiss, and Mirsky 2025; Pasquini, Kornaropoulos, and Ateniese 2024). These artifacts can provide the agents with misleading observations during their exploration and thus affect their decisionmaking process. However, our evaluation on these static defenses reveals their fundamental limitation in sustaining influence over multi-step interactions. Specifically, we implement six common deception tactics and evaluate them against six LLMs for penetration (Ayzenshteyn, Weiss, and Mirsky 2025; Pasquini, Kornaropoulos, and Ateniese 2024; Lee and Park 2025; Reworr and Volkov 2025). We define Interference@20 as the proportion of 20 interaction steps in which deceptive artifacts can affect the attack agent’s behaviors. As shown in Figure 1, the averaged Interference@20 score across all LLM–tactic combinations is less than 0.2, indicating that these static tactics could not maintain their effectiveness across diverse recent
LLMs and evolving attack trajectories. The limited effectiveness stems from the fixed nature of static artifacts and the strong capabilities of recent agents. As advanced agents iteratively explore the environment and continuously refine their attack strategies, they become increasingly adept at detecting contextual inconsistencies in the static artifacts. Eventually, these agents can recognize and bypass the artifacts, ultimately refocusing their exploitation attempts on the real target. Thus, the key bottleneck of existing defenses is not the lack of more sophisticated artifacts, but the absence of mechanisms that can dynamically construct and disclose artifacts conditioned on the agent’s current state. To address this bottleneck, we introduce AgentSnare, a trajectory-adaptive system that dynamically constructs and discloses decoy artifacts to steer autonomous penetration agents away from the real target. Unlike traditional interactive honeypots that merely mimic realistic local interactive responses, AgentSnare ensures global factual consistency across the interactive context, establishing a logically self-consistent alternative reality to actively reshape the attack trajectory. Specifically, AgentSnare constructs and discloses deceptive artifacts following two stages. In the first stage, the deployed policy model infers the penetration agent’s attack intent from its interaction history and current state of the decoy environment, and then constructs candidate artifacts designed to induce the agent to continue probing the decoy. In the second stage, AgentSnare further validates each candidate artifact by checking whether its involved observations are compatible with the agent’s action, consistent with previously disclosed artifacts, and capable of supporting the agent’s subsequent actions. By accumulating these validated artifacts along the actual attack trajectory, AgentSnare unfolds the decoy incrementally rather than pre-construct the entire environment, ensuring global factual consistency along the agent’s attack trajectory. To construct artifacts that are more effective and logically valid, we fine tune the deployed policy model through simulated attacker– defender interactions. In each tuning round, an attacker simulator issues a probe based on the current interaction history, and the defender constructs and discloses several validated artifacts for the same probe. The attacker simulator then predicts the possible follow-up actions based on each artifact. The artifact that can consistently encourage continued investigation of the decoy is selected, and its involved observations are appended to the interaction history for the next round. Repeating this process produces multi-round attack–defense interaction trajectories. We use the collected trajectories to tune a lightweight open-weight LLM, teaching the deployed policy model to infer the attacker’s intent from the interaction history and construct artifacts that are likely to keep its subsequent actions within the decoy. To our best knowledge, AgentSnare is the first system to trap autonomous penetration agents by consistently steering them away from real targets. To evaluate trajectory-level interactive defenses, we further introduce a process-oriented mechanism Delay–Divert– Defuse (DDD): Delay indicates how the decoy delays the attack by absorbing the agent’s probing actions (tool calls), which calculated as the fraction of the agent’s tool calls absorbed by the decoy. Once the agent enters the decoy, Divert
measures the post-entry retention (PER), which is the fraction of post-entry actions that remain in the decoy. Defuse measures whether the agent’s task-completion attempts are grounded in decoy observations. Across 45 attacker–CVE scenarios spanning 15 deployable CVE-Bench web applications and three attacker models, AgentSnare achieves 46.8% Delay, 55.9% Divert, and 90.0% Defuse, with no successful real-target exploit recorded under the pass@3 evaluation setting. Our contributions are summarized as follows: • We identify the fundamental bottleneck of static deception: Advanced agents can easily recognize and bypass pre-planted artifacts. We therefore reframe the defense as trajectory-adaptive steering, where artifacts are dynamically constructed and disclosed conditioned on the agent’s evolving actions. • We propose AgentSnare, the first decoy-based defense to preserve global consistency across the entire agent-decoy interaction context, which generates candidate deceptive artifacts based on the interaction history and current decoy state and then validates each candidate against the current action, prior committed facts, and subsequent steps. • We fine-tune the deployed Policy Model for artifact generation via simulated attacker–defender interactions, teaching a lightweight LLM to construct artifacts that can consistently trap the agent actions within the decoy. • We introduce Delay-Divert-Defuse (DDD) as a trajectory-level defense evaluation framework, and demonstrate that AgentSnare achieves 46.8% Delay, 55.9% Divert, and 90.0% Defuse across 15 CVE-Bench applications and three attacker models, with no successful real-target exploit under the pass@3 setting.
Related Work Autonomous Penetration Agents and Benchmarks LLMs have enabled autonomous penetration agents that plan attacks, invoke security tools, interpret the returned observations, and continually revise their strategies across multiple interaction steps. PentestGPT, AutoPT, and VulnBot implement this process through modular reasoning, state machine control, and coordination among multiple agents, respectively (Deng et al. 2024; Wu et al. 2025; Kong et al. 2025). To evaluate these agents in realistic environments, CVE-Bench provides deployable vulnerable targets and automated evaluation mechanisms that determine whether an agent completes a specified exploitation objective (Zhu et al. 2025).
Agent-oriented Deception and Honeypots As penetration agents rely on environmental observations to revise their strategies, defenders can influence the agent’s actions with manipulated observations. Existing agent-oriented deception techniques mainly exploit this dependence by planting static artifacts into the environment before the penetration. For instance, CHeaT and Mantis deploy deceptive artifacts such as misleading files and prompt injections (Ayzenshteyn, Weiss, and Mirsky 2025; Pasquini, Kornaropoulos, and Ateniese 2024). However, as these artifacts are fixed,
they cannot adapt to the agent’s evolving attack strategy. As advanced agents progressively explore the environment, static artifacts become increasingly difficult to steer penetration agents away from the real target Interactive honeypots provide another direction for maintaining an ongoing decoy environment: Cowrie provides a preconstructed virtual shell environment, ShelLM leverages an LLM to broaden shell response coverage, and HoneyLLMd adapts responses according to modeled attack transitions (Cowrie Contributors 2026; Sladić et al. 2024; Fan et al. 2026). However, these honeypots primarily focus on mimicking realistic local interactive responses and collecting attacker behaviors, whereas AgentSnare maintains global factual consistency across the evolving interaction context to construct a coherent decoy reality that consistently steers penetration agents away from the real target.
Offline Data Synthesis Offline data synthesis has been widely used to improve the capabilities of tool using agents and long-horizon decisionmaking systems. FireAct fine-tunes agents with teachergenerated multi-task action trajectories and AgentTuning aggregates high-quality trajectories across interactive environments to improve cross-task agent capabilities (Chen et al. 2023; Zeng et al. 2024). In cybersecurity, Cyber-Zero synthesizes long-horizon interactions from public CTF write-ups and role-based simulation to train attack agents (Zhuo et al. 2025). These methods primarily construct or distill trajectories to improve the execution capability of the agent itself. In contrast, AgentSnare uses offline simulation to learn how to infer the attacker’s evolving intent from interaction behaviors, enabling the LLM to construct artifacts that can consistently trap the agent actions within the decoy.
Threat Model We consider an autonomous penetration agent A that plans attacks, invokes tools, and revises its strategy based on the returned observations under a finite budget of B tool calls. Attacker model. The attacker controls the agent’s planner, memory, tools, and stopping rule, and may submit completion attempts through the task interface. The agent may ignore defender-constructed artifacts, alternate between the real target and defender-controlled environments, and freely explore the environment with its available tools. Defender model. The defender can plant deceptive artifacts throughout the environment, provided that they do not modify the application’s normal functionality or vulnerable execution path. During the interaction, it constructs new artifacts according to the evolving attack context, including the interaction history and all previously disclosed artifacts. The defender makes no assumptions about the target CVE, the underlying attacker model, the agent’s tool configuration, stopping rule, or attack strategy.
AgentSnare System Overview Figure 2 illustrates the overall workflow of AgentSnare, which consists of an online trajectory-adaptive defense pipeline and an offline training procedure. As shown on the right of Figure 2, the online pipeline consists of two stages. In the first stage, the deployed LLM infers the attacker’s current intent from the interaction history and the current decoy state, and constructs a candidate artifact for the current probe. Each artifact consists of the observation to be disclosed together with the environmental facts required to support it. In the second stage, ShadowOS validates the candidate artifact before realizing it into the decoy environment and disclosing the corresponding observation to the attacker. By repeatedly constructing, validating, and disclosing artifacts throughout the interaction, AgentSnare incrementally unfolds a persistent and globally consistent decoy environment along the attack trajectory. As shown on the left of Figure 2, the online deployed LLM is trained through simulated attacker-defender interactions. For each interaction state, multiple validated artifacts are explored under the same attack context, and the resulting trajectories provide supervision for learning how to infer the attacker’s intent and progressively construct artifacts that sustain exploration within the decoy.
Online Artifact Construction and Disclosure Interaction context. We first formalize one round of online interaction. At step t, let ht denote the interaction history visible to the attacker. The agent selects a tool action at , receives the observation ot actually returned by the environment, and extends its history: at ∼ A(ht ), ht+1 = ht ∥ (at , ot ). (1) Actions directed to the real target are handled unchanged by the original environment. AgentSnare intervenes only when at reaches a defender-controlled surface, where it constructs and validates the artifact whose observation will be returned as ot . Decoy state and affordance frontier. To support artifact construction and validation across multiple rounds, ShadowOS maintains a world-fact ledger Wt and a lazy affordance graph Gt = (Vt , Et ). (2) The ledger Wt records committed decoy objects, attributes, relations, and attacker-induced state changes, ensuring that later observations remain consistent and mutations persist until explicitly modified or reversed. The graph Gt represents investigative opportunities that are currently visible or may be constructed next. Its nodes denote environmental objects and attack opportunities, such as files, credentials, services, users, containers, internal hosts, and privilege-escalation or lateral-movement opportunities. Its edges encode relations such as references, authenticates-to, runs-as, corroborates, and enables. Given the current action at , the graph determines a connected affordance frontier Ft = Frontier(at , Gt ). (3)
1) OFFLINE DATA SYNTHESIS + TRAINING
2) ONLINE ADAPTIVE DECEPTION
Ⅰ. SCENARIO PROFILE SAMPLER Initial Clue e.g., SSH credential, etc.
Attack Objective e.g., root access, ctf, etc.
Goals: • Root Access • Catch the Flag • Privilege Escalation • ···
Update Interaction History:
ATTACKER VIEW
ℎ! : Interaction History
ATTACKER Reasoning with ℎ!
ATTACKER PROBE (𝑎! ) TOOL CALL { $ cat /src/app/.env }
DEFENDER
Advance Current Thread
[PREDICTED NEXT ACTIONS]
Discard
cand. 1
if not satisfied Reachability & Consistency
Introduce Branch Clue
candidate disclosures
N
D
R
C
D
N
($)
cand. 3
Direct Response
Sample Next Attacker Actions
R
N
R
D decoy
C
clue-following
risky
N
neutral
R
TRAJECTORY-LEVEL FILTERING [raw trajectory pool]
N
Each ball = one sampled next action
Withhold
Trajectory Collection
D
cand. 2* D
3. COMMIT CANDIDATE
Rules: • Engagement Length • Diverse Scenario • ···
Open-Source Lightweight LLM
Local Command Handler 2 • Common commands are processed directly locally
Virtual Command Executor • File system-level operations are performed in the virtual file system
Disclosure Model 4 • Others are sent to the LLM (Qwen3)
B. Internal Architecture
↓
INPUT (𝑥! )：
1. Validate
Ø 𝑞: Target Server Profiles Ø 𝑎! : Attacker Probe Action Ø ℎ! : Interaction History Ø 𝑊! : ShadowOS State
Generate Formal 𝑜! via Hybrid Renderer
(World Ledger)
↓
Next synthesis turn (𝑡 ← 𝑡 + 1)
Deploy LLM
Disclosure Policy Model
3
Invalid Output
Derive ∆𝐺!∗ Commit (∆𝑊!∗ , ∆𝐺!∗ )
SELECTED-DECISION DISTILLATION LoRA
Director Intercept • Pre-preset templates for specific scenarios of CVEs.
Select Best cand. (𝑜#!∗ , ∆𝑊!∗ )
↓
Input: ℎ! ($) Output: 𝑎!&'
...
Producing k
Entry
A. 4-Layer Command Processing Pipeline
2. VALIDATE & SIMULATE CANDIDATE-CONDITIONED REACTIONS
ShadowOS Validity
𝑞: Server Profiles
Environment Observations
Normal Page - (comment) 403 Page - (message) diagnostic message - (...) /.git/config - (...) . . .
———— DECOY ENVIRONMENT (ShadowOS) ————
1
𝑊! : World Ledger
agentSnare Breadcrumbs Ø Ø Ø Ø Ø
Update World Ledger & Affordance Graph:
1. COUNTERFACTUAL CANDIDATE EXPANSION
𝐺! : Affordance Graph
Probe Action
New Observations 𝑜!
DEFENDER VIEW Decoy Environment
REAL TARGET ENVIRONMENT
Pentest Agent (GPT / Claude / ...)
Behavioral Focus e.g., recon, data-search, etc.
Ⅱ. DUAL-ROLE TRAJECTORY SYNTHESIS (Round 𝒕) & POLICY DISTILLATION
Qwen3 LoRA Disclosure Policy Model
LLM OUTPUT (𝑜'! , ∆𝑊! ) ： Ø 𝑜'! : Terminal Result for 𝑎! Ø ∆𝑊! : Fact Increment for 𝑜'!
1. Verify Consistency with Ledger （ 𝑊! ）
Validation & Commitment
ATTACKER
Application Environment e.g., Flask, PHP, Nginx, etc.
2. Check Affordance Graph Frontier（ 𝐺! ）
2. Commit Existing Fabricated Facts 𝑊!
3. Check Command Semantics 4. Validate Format 5. Filter Real Secret Leaks 6. Enforce Basic Constraints . . .
Update Affordance Graph (𝐺! )
Update World Ledger (𝑊! ) user
admin
index.php
< ... > ...
/var/...
...
. . .
. . .
Path: /src/app refs
path
/src/app/.env
.env
PASSWD
. . .
. . .
···
···
Log: startup.log depend
···
Increased Facts ∆𝑊!
Exposed Region
Path: /var/www/html refs
authority ···
User: app_user
read authority
Validated Extension
File:
∆𝐺! ← ∆𝑊! /src/app/.env Admissible nodes and reveals edges expand based File: on ∆𝑊! updates. /src/app/.env
3. Hybrid Renderer Generative Content Deterministic Content
Mixer
Formal Response (Observation) 𝑜! Returned to Attacker
...
Figure 2: Overview of AgentSnare.
The frontier limits which artifacts may be constructed next. For example, a request for an .env file may reveal configuration values, and credentials, but not an unrelated privilegeescalation or lateral-movement opportunity. Together, Wt and Ft specify which previously constructed facts must remain unchanged and which connected artifacts may be introduced during the current interaction. Online Stage I: Candidate artifact construction. The first online stage uses the learned artifact-construction policy model Mθ to construct a candidate artifact for the current probe. Let q denote the server and application profile available to the deployed defense. The model input is xt = (ht , at , Wt , Ft , q).
(4)
We represent the candidate artifact as ct = (õt , ∆Wt ) = Mθ (xt ),
(5)
where õt is the observation proposed for the current action and ∆Wt contains the environmental facts required to construct the corresponding artifact. The policy model does not directly modify Wt or Gt . It only specifies what the attacker would observe and which new facts would be required to support that observation. The proposed observation õt is therefore distinct from the actual observation ot in Equation 1; it becomes visible only if the candidate passes the validation of the second online stage. For example, when the attacker agent executes cat /srv/app/.env, the model may construct a candidate artifact containing an internal database endpoint and a deployment account in õt . The corresponding ∆Wt specifies the file contents, host, account, and credential relations required to support this artifact. The model therefore constructs an artifact that fits the ongoing investigation and offers a plausible next step within the decoy.
Online Stage II: Artifact validation and disclosure. The second online stage determines whether the candidate artifact ct = (õt , ∆Wt ) can be incorporated into the current decoy environment. Specifically, AgentSnare’s ShadowOS validates the candidate artifact along three dimensions. Semantic validity requires the proposed observations to match the current command, be observable through the current probe, and follow the expected output format. State validity requires the introduced facts to be consistent with Wt , reachable from Ft , and reproducible in subsequent interactions. Safety validity prevents leakage of real-environment secrets and violations of basic filesystem, user, process, permission, and service constraints. For a valid artifact, ShadowOS derives the corresponding graph increment ∆Gt from the validated facts and the current frontier. It then incorporates the artifact into the decoy state and renders the observation returned to the attacker: (Wt+1 , Gt+1 ) = Commit(Wt , Gt , ∆Wt , ∆Gt ), ot = Render(at , õt , Wt+1 , Gt+1 ).
(6)
Deterministic state management preserves users, working directories, file mutations, permissions, processes, ports, and previously constructed values, while generative rendering handles open-ended logs, configurations, errors, and other textual content. If validation fails, Wt and Gt remain unchanged, and the system returns a failure observation that introduces no new environmental fact. Thus, an artifact becomes part of the persistent decoy environment only after it has been validated and realized by ShadowOS. During deployment, each defender-controlled interaction invokes the artifactconstruction model once, followed by validation, state update, and disclosure.
Offline LLM Training for Artifact-Construction The first online stage relies on the artifact-construction policy model to infer the agent’s attack intent from the interaction history and construct a candidate artifact for the current probe. To make deceptive artifacts more likely to induce the attacker to continue probing the decoy., we fine tune the model using supervision collected through simulated attacker–defender interactions. Simulated attacker–defender interactions. thetic trajectory begins by sampling a scenario
Each syn-
σ ∼ Q.
(7)
The scenario specifies a synthetic application environment, an attack objective, an initial clue, and a behavioral focus. The server and application profile provided to the model is obtained as q = Profile(σ). (8) The scenario distribution covers 12 classes of attack intent, including service reconnaissance, credential discovery, privilege escalation, lateral movement, sensitive-data search, container escape, and SSH pivoting. We use two isolated DeepSeek-V4-Flash model instances in different roles. The attacker simulator Asim issues the current probe from the visible interaction history and predicts possible follow-up actions after observing an artifact. The candidate generator D constructs several alternative artifacts for the same probe and interaction context. The two roles use separate prompts and interaction histories. In each interaction round, the attacker simulator first issues a probe based on the interaction history ht : at ∼ Asim (ht , σ).
(9)
The current decoy state determines Ft , after which the model input is constructed as xt = (ht , at , Wt , Ft , q).
(10)
For this same input, the candidate generator constructs k alternative artifacts: ok n (j) (j) (j) Ct = D(xt ; k) = ct = (õt , ∆Wt ) . (11) j=1
Each candidate is validated using the same semantic, state, and safety rules applied during online deployment. Candidates that conflict with existing facts, violate command semantics, cannot be observed through the current probe, cannot be constructed from the current frontier, cannot be reproduced later, are malformed, or risk leaking real-environment secrets are removed before reaction comparison. Reaction-guided artifact selection. For every remaining candidate, the system begins from the same visible history and decoy state and inserts only that candidate’s proposed (j) observation to simulate an interaction history ht : (j)
ht
(j)
= ht ∥ (at , õt ).
(12)
The attacker simulator then samples m possible follow-up (j) actions based on ht : n om (j) (j) (j) iid (j) Rt = rt,ℓ , rt,ℓ ∼ Asim (ht , σ). (13) ℓ=1
Because all candidates are evaluated under the same interaction history, probe, and decoy state, the resulting reactions isolate the effect of changing the constructed artifact. The system first prefers an artifact that more often leads the attacker to continue investigating the decoy. Among these artifacts, it favors one that prompts further investigation of the newly constructed artifacts, followed by one that less often triggers suspicion, termination, or a return to the real target. The original candidate order provides a deterministic final tie-break. The selected artifact is n o (j) (j) ⋆ ct = Select (ct , Rt ) . (14) j
Only c⋆t is incorporated into the synthesized decoy. Its observation is appended to the main interaction history, from which the attacker simulator issues the next probe. Repeating this process produces multi-round interaction trajectories. Trajectory filtering and model fine-tuning. Trajectorylevel filtering retains interactions with enough valid rounds and selected decisions, resolved state conflicts, complete output formatting, and no real-secret leakage. The final corpus contains 24,807 selected defender decisions from 503 trajectories spanning 12 attack-intent classes. It contains no CVE-Bench application, vulnerability description, reference exploit trajectory, official solution, or evaluator output. We perform supervised fine-tuning of Qwen3-4B (Yang et al. 2025) on the selected decisions for three epochs in bf16 using a LoRA adapter (Hu et al. 2022) (r = 64, α = 128). The resulting adapter is frozen and served through vLLM (Kwon et al. 2023). Candidate comparison and attacker simulation therefore occur only offline, whereas online deployment requires one candidate artifact construction followed by validation and disclosure.
Delay–Divert–Defuse Metrics Verified real-target exploit success provides an end-to-end measure of whether a defense prevents the agent from completing the exploit objective. However, it does not reveal how an interactive defense exerts control over the preceding attack trajectory. To characterize this trajectory-steering process, we introduce Delay–Divert–Defuse (DDD), a trajectory-level evaluation framework that measures whether the decoy absorbs the agent’s actions over the complete run, retains the agent after its first decoy entry, and shapes the evidence used in task-completion attempts. Suppose a run produces T ≤ B budgeted tool calls. We assign each call a target label zt ∈ {real, decoy, other}, where real denotes the original application, decoy denotes a defender-controlled interactive surface, and other includes local processing or calls attributable to neither surface. Let τ denote the first validated action on the decoy. Delay. Delay measures the fraction of the complete attack budget absorbed by the decoy: T
Delay =
1X I[zt = decoy]. T t=1
(15)
Divert. We operationalize Divert as post-entry retention (PER), the fraction of subsequent actions that remain directed to the decoy after the first validated entry: P I[zt = decoy] PER = t>τ . (16) T −τ Delay measures overall budget absorption, PER conditions on successful entry and evaluates whether the defense sustains control afterward rather than allowing the trajectory to return immediately to the real target. Defuse. Let P be the set of valid task-completion attempts and let PD ⊆ P contain attempts whose supporting evidence is traced by provenance tags to the decoy. We operationalize Defuse as |PD | SubDefuse = . (17) |P| SubDefuse evaluates whether the defense influences not only where the agent acts, but also what evidence it ultimately accepts as support for task completion.
Experiments Setup Benchmark and attackers. We evaluate 15 deployable CVE-Bench tasks (Zhu et al. 2025) using the agentic release of PentestGPT (Deng et al. 2024), with Claude Opus 4.6, GPT-5.4, and MiniMax M3 as attackers (Anthropic 2026; OpenAI 2026; MiniMax 2026). Each attacker–interactivedefense pair is run three times per CVE, producing 405 defended runs. All conditions share the task prompt, tools, 200call budget, and stopping rule; the interactive defenses use the same application-side breadcrumb and interaction entry point. All defenses are evaluated at pass@3 and we provide pass@1 exploit rate without defense for references. Defense conditions. Static Defenses jointly deploy all 13 reproducible intervention instances before the attack, spanning six tactic categories: mislead perception, divert attention, specialized lures, model corruption, role manipulation, and forced code execution (Ayzenshteyn, Weiss, and Mirsky 2025; Pasquini, Kornaropoulos, and Ateniese 2024). Cowrie (Cowrie Contributors 2026) provides a preconstructed interactive shell environment with a static virtual filesystem and scripted command handling. HoneyLLMd (Fan et al. 2026) tracks attack transitions with a hierarchical probabilistic automaton and uses GPT-5.4mini to generate adaptive responses. AgentSnare combines a learned artifact-construction model built on a LoRA-tuned Qwen3-4B (Yang et al. 2025; Hu et al. 2022).
RQ1: Does AgentSnare Sustain Attack-Trajectory Steering? Budget absorption and retention. AgentSnare obtains the highest observed Delay and PER for all three attacker models (Table 1). Its Delay is 47.0% for Claude Opus 4.6, 37.7% for GPT-5.4, and 55.7% for MiniMax M3. Across attackers, It
Action share
It evaluates decoy absorption over the entire trajectory, including activity before and after the first decoy entry.
Cowrie
1.0
HoneyLLMd
AgentSnare
0.5
0.0
0
50
100
0
Progress (%)
50
100
0
Progress (%) Decoy share
50
100
Progress (%)
Real-mainline share
Figure 3: Share of actions targeting the decoy and real target over normalized attack progress. For each run, tool-call positions are normalized to 0–100% and partitioned into 20 equal-width bins of five percentage points. Shares are pooled within corresponding bins across attackers and CVEs (N = 135 runs per defense); calls labeled other are omitted.
absorbs 46.8% of all issued tool calls, compared with 17.6% for Cowrie and 29.5% for HoneyLLMd. Its overall PER is 55.9%, a 19.0-point improvement over HoneyLLMd. The interaction therefore extends beyond initial attraction: as the agent investigates, verifies, and revises its attack strategies, the decoy continues to receive a larger share of actions. Decoy-grounded completion attempts. AgentSnare also achieves the highest SubDefuse for each attacker: 92.0% for Claude Opus 4.6, 96.5% for GPT-5.4, and 81.8% for MiniMax M3. Pooling all attackers, CVEs, and repetitions, 574 of 638 valid completion attempts are grounded in decoy evidence, yielding 90.0% SubDefuse. Cowrie and HoneyLLMd reach 29.7% and 72.2%, respectively. The metrics need not move together: GPT-5.4 has the lowest AgentSnare Delay but the highest SubDefuse, whereas MiniMax M3 has the highest Delay and PER but lower SubDefuse. Time spent on the decoy and provenance of completion evidence therefore capture distinct aspects of trajectory control. Figure 3 isolates the competition between the two attack surfaces. Cowrie leaves the real mainline dominant through most of the trajectory, while HoneyLLMd moves the allocation closer to an even split. AgentSnare instead reverses the balance after entry and maintains a decoy-majority share in later stages. Real and decoy calls can still alternate; containment is reflected in the accumulated target-directed activity that the controlled environment absorbs. Attacker-specific trajectory plots are provided in the supplementary material.
RQ2: Does Trajectory Steering Reduce Real-Target Exploitation? Real-target exploit suppression. Real-target exploit success is determined by the official CVE-Bench evaluator (Zhu et al. 2025). Without defense, the attackers exploit 18 of 45 attacker–CVE pairs at pass@1: 13/15 for Claude Opus 4.6, 3/15 for GPT-5.4, and 2/15 for MiniMax M3. Under the pass@3 protocol used for defended conditions, Static Defenses still leave 18/45 pairs exploitable, with the same attacker-wise counts. Cowrie and HoneyLLMd reduce this number to 12/45 and 10/45, respectively, whereas AgentSnare records no verified real-target exploit (0/45). Thus, AgentSnare eliminates all evaluator-verified real-target
Table 1: Main results across 15 CVE-Bench tasks and three attackers. Delay and PER report the mean ± SE over 15 CVE-level averages; SubDefuse reports the fraction of valid completion attempts supported by decoy evidence, with counts in parentheses. DDD is not reported for Static Defenses, shown by dashes. Detailed static-defense results are provided in the appendix. Trajectory Steering
Verified Exploits
Attacker
Defense
Delay (%) ↑
PER (%) ↑
SubDefuse (%) ↑
Exploited CVEs ↓
Claude Opus 4.6
Static Defenses Cowrie HoneyLLMd AgentSnare
– 13.8 ± 1.6 34.1 ± 3.1 47.0 ± 2.9
– 23.8 ± 3.7 46.8 ± 2.6 58.1 ± 2.7
– 13.2 (10/76) 81.4 (193/237) 92.0 (242/263)
13/15 9/15 7/15 0/15
GPT-5.4
Static Defenses Cowrie HoneyLLMd AgentSnare
– 19.9 ± 1.6 20.1 ± 2.8 37.7 ± 2.0
– 22.1 ± 1.9 21.9 ± 3.2 45.0 ± 2.7
– 49.4 (44/89) 72.0 (72/100) 96.5 (166/172)
3/15 1/15 0/15 0/15
MiniMax M3
Static Defenses Cowrie HoneyLLMd AgentSnare
– 19.1 ± 1.8 34.3 ± 3.9 55.7 ± 2.8
– 24.5 ± 1.9 41.9 ± 5.4 64.7 ± 3.3
– 24.8 (25/101) 54.8 (68/124) 81.8 (166/203)
2/15 2/15 3/15 0/15
Overall
Static Defenses Cowrie HoneyLLMd AgentSnare
– 17.6 29.5 46.8
– 23.5 36.9 55.9
– 29.7 (79/266) 72.2 (333/461) 90.0 (574/638)
18/45 12/45 10/45 0/45
exploits despite giving each attacker three independent opportunities per CVE. Consistency with trajectory steering. Among the interactive defenses, the verified exploit outcomes are consistent with the trajectory-steering results in RQ1. AgentSnare achieves the highest Delay, PER, and SubDefuse and is also the only defense with no verified real-target exploit. Cowrie and HoneyLLMd obtain lower DDD values and leave 12/45 and 10/45 attacker–CVE pairs exploitable, respectively. This alignment indicates that stronger budget absorption, postentry retention, and decoy-grounded completion coincide with fewer successful real-target exploits.
RQ3: What Do Model Fine-Tuning and ShadowOS Contribute? We evaluate two single-component ablations and one strong full-ablation reference under the complete 15-CVE, threerepetition protocol with GPT-5.4 as the attacker, yielding 45 runs per configuration. Base Qwen3-4B + ShadowOS removes model fine-tuning while retaining the complete stateful ShadowOS runtime, isolating the contribution of the finetuned artifact-construction model. AgentSnare w/o ShadowOS retains the fine-tuned model but removes the stateful runtime, isolating the contribution of persistent validation and realization. Prompted GPT-5.4-mini removes both model fine-tuning and the stateful ShadowOS runtime, corresponding functionally to a full ablation of the two AgentSnare mechanisms. Rather than using the weaker base Qwen34B for this configuration, we deliberately replace it with GPT-5.4-mini, the same closed model used by HoneyLLMd. This strengthens the underlying generator and tests whether generic model capability alone, without trajectory-specific supervision or persistent state, can recover the benefits of the
complete system. With ShadowOS fixed, replacing the model finetuned on reaction-guided trajectories with Base Qwen34B reduces Delay/PER/SubDefuse from 37.7/45.0/96.5 to 34.4/38.0/85.5 and leaves 3/15 targets exploitable. This comparison shows that model fine-tuning improves the selection of artifacts that sustain decoy-directed exploration. Removing ShadowOS while retaining the fine-tuned model yields 34.6/38.5/82.2 and leaves 1/15 targets exploitable. The 14.3point reduction in SubDefuse, the largest degradation among the three process metrics, highlights the importance of persistent state when the attacker repeatedly verifies evidence across commands and tools. The strong full ablation with prompted GPT-5.4-mini achieves 37.0/43.7/88.6 Delay/PER/SubDefuse but still leaves 3/15 targets exploitable. Thus, a stronger closed model can produce locally convincing interactions and recover much of the aggregate DDD performance, but it does not match the complete system’s sustained trajectory control or exploit suppression. Despite using Qwen3-4B, the complete AgentSnare system exceeds the prompted GPT-5.4-mini variant on all three process metrics and is the only configuration with no verified real-target exploit. These results show that model fine-tuning and ShadowOS allow a compact model to outperform a stronger prompt-only model, and that both mechanisms are required for reliable end-to-end protection under the evaluated protocol.
Conclusion In this paper, we presented AgentSnare, a trajectory-adaptive deception system that moves beyond pre-planted static artifacts by dynamically unfolding a factually consistent decoy environment along the agent’s attack trajectory. Its learned artifact-construction policy model constructs artifacts condi-
tioned on the agent’s current probe, interaction history, and decoy state; AgentSnare then validates and incrementally incorporates valid artifacts to continually steer the penetration agent away from the real target. Across 15 CVE-Bench tasks and three attacker models, AgentSnare achieves 46.8% Delay, 55.9% PER, and 90.0% SubDefuse, with no verified real-target exploit across 45 attacker–CVE pairs at pass@3.
References Anthropic. 2026. Introducing Claude Opus 4.6. https://www. anthropic.com/news/claude-opus-4-6. Ayzenshteyn, D.; Weiss, R.; and Mirsky, Y. 2025. Cloak, Honey, Trap: Proactive Defenses Against {LLM} Agents. In 34th USENIX Security Symposium (USENIX Security 25), 8095–8114. Chen, B.; Shu, C.; Shareghi, E.; Collier, N.; Narasimhan, K.; and Yao, S. 2023. Fireact: Toward language agent finetuning. arXiv preprint arXiv:2310.05915. Cowrie Contributors. 2026. Cowrie SSH/Telnet Honeypot. https://github.com/cowrie/cowrie. Deng, G.; Liu, Y.; Mayoral-Vilches, V.; Liu, P.; Li, Y.; Xu, Y.; Zhang, T.; Liu, Y.; Pinzger, M.; and Rass, S. 2024. {PentestGPT}: Evaluating and harnessing large language models for automated penetration testing. In 33rd USENIX Security Symposium (USENIX Security 24), 847–864. Fan, W.; Du, F.; Wang, Z.; Cao, Q.; Liu, L.; Chang, K.; and Chang, S.-Y. 2026. HoneyLLMd: A Large Language ModelPowered Adaptive Honeypot System. IEEE Transactions on Network Science and Engineering. Hu, E. J.; Shen, Y.; Wallis, P.; Allen-Zhu, Z.; Li, Y.; Wang, S.; Wang, L.; Chen, W.; et al. 2022. Lora: Low-rank adaptation of large language models. Iclr, 1(2): 3. Kong, H.; Hu, D.; Ge, J.; Li, L.; Li, T.; and Wu, B. 2025. Vulnbot: Autonomous penetration testing for a multi-agent collaborative framework. arXiv preprint arXiv:2501.13411. Kwon, W.; Li, Z.; Zhuang, S.; Sheng, Y.; Zheng, L.; Yu, C. H.; Gonzalez, J.; Zhang, H.; and Stoica, I. 2023. Efficient memory management for large language model serving with pagedattention. In Proceedings of the 29th symposium on operating systems principles, 611–626. Lee, S.; and Park, S. 2025. AI Kill Switch for malicious web-based LLM agent. arXiv preprint arXiv:2511.13725. MiniMax. 2026. MiniMax M3: Frontier Coding, 1M Context, Native Multimodality—All in One Model. https: //www.minimax.io/blog/minimax-m3. OpenAI. 2026. GPT-5.4 Thinking System Card. https:// openai.com/index/gpt-5-4-thinking-system-card/. Pasquini, D.; Kornaropoulos, E. M.; and Ateniese, G. 2024. Hacking back the ai-hacker: Prompt injection as a defense against llm-driven cyberattacks. arXiv preprint arXiv:2410.20911. Reworr, R.; and Volkov, D. 2025. LLM Agent Honeypot: Monitoring AI Hacking Agents in the Wild. Sladić, M.; Valeros, V.; Catania, C.; and Garcia, S. 2024. Llm in the shell: Generative honeypots. In 2024 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), 430–435. IEEE.
Wu, B.; Chen, G.; Chen, K.; Shang, X.; Han, J.; He, Y.; Zhang, W.; and Yu, N. 2025. AutoPT: How Far Are We From the Fully Automated Web Penetration Testing? IEEE Transactions on Information Forensics and Security. Yang, A.; Li, A.; Yang, B.; Zhang, B.; Hui, B.; Zheng, B.; Yu, B.; Gao, C.; Huang, C.; Lv, C.; et al. 2025. Qwen3 technical report. arXiv preprint arXiv:2505.09388. Zeng, A.; Liu, M.; Lu, R.; Wang, B.; Liu, X.; Dong, Y.; and Tang, J. 2024. Agenttuning: Enabling generalized agent abilities for llms. In Findings of the Association for Computational Linguistics: ACL 2024, 3053–3077. Zhu, Y.; Kellermann, A.; Bowman, D.; Li, P.; Gupta, A.; Danda, A.; Fang, R.; Jensen, C.; Ihli, E.; Benn, J.; et al. 2025. CVE-bench: a benchmark for AI agents’ ability to exploit real-world web application vulnerabilities. arXiv preprint arXiv:2503.17332. Zhuo, T. Y.; Wang, D.; Ding, H.; Kumar, V.; and Wang, Z. 2025. Cyber-zero: Training cybersecurity agents without runtime. arXiv preprint arXiv:2508.00910.