Future of AI Honeypots

TL;DR. As AI agents get better, I expect them to recognize honeypots and avoid fingerprinting, so honeypots will have to rely on the distinctive advantages of AI, namely the combination of intelligence and speed. I also expect honeypots to rely more on real software with different levels of protection rather than on deliberately left vulnerabilities. In 2024 we detected agents with prompt injections in the style of the "important message" attack from AgentDojo,[1] placed in the SSH banner and in command outputs.[2] The injections asked for a password that needs language understanding to find (e.g., "the password is the first US president's name"), so that passing the trap became the signal of an LLM. Frontier models then started to detect the emulated Cowrie shell itself within a few seconds from basic shell features that did not work (e.g., shell arithmetic), so I moved the honeypot to a real Debian server. I expect honeypot awareness will grow in the same way as evaluation awareness, and agents will notice small inconsistencies better and better, up to reasoning like "these commands have 0.6 seconds more latency, so this is likely a honeypot".[3] In an Apollo Research evaluation, Gemini 4 Argon addressed the evaluators through its chain of thought after being directly asked whether it was in an evaluation. The excerpt is from Google DeepMind's report. Prompt injection traps are also becoming less effective, since models get better at recognizing them.[4][5] Still, some prompt injections would probably remain effective longer, such as posing the malicious task as a prerequisite for completing the user task,[6][7] since an agent cannot ignore an obstacle without failing its own task. For example, a captcha in front of a site can ask for sensitive data (or, in a honeypot, for the agent's model name). Over time, I still expect models to recognize these too and to stop sharing real information whenever they have reasons to avoid detection. Swarms make this problem even