Vami Research · Research program
VamiHoney is the honeypot program of Vami Research. We operate decoy systems for web applications, infrastructure, and AI services that deliberately attract AI agents. Every session is analyzed: human, script, or agent? Which tools, which objectives, which patterns? The answers produce a threat briefing that feeds back into VamiGRC, our tests, and attack detection.
Status: Program in developmentThe first sensors are being prepared. We will publish results as soon as they are reliable.
Classic honeypots were built for humans and scripts. AI agents behave differently: they read banners and error messages as instructions, call tools, and pursue a goal across many steps. What public research has shown so far:
of an espionage campaign that Anthropic detected in September 2025 was carried out by an AI agent, according to the company. Humans were left to make only about four to six critical decisions per campaign.
Anthropic, November 2025 (opens external website)access attempts on an SSH honeypot were classified by Palisade Research as potential AI agents over roughly three months: rare, but real.
Palisade Research, February 2025 (opens external website)attack sessions were counted by GreyNoise on its Ollama honeypots from October 2025 to January 2026, including a systematic search for misconfigured access to more than 70 LLM models.
GreyNoise, January 2026 (opens external website)of the responses from 21 language models fell into deception traps in a test by Horizon3.ai; among humans, the figure was 37%. The models often recognized the trap and walked into it anyway.
Horizon3.ai, June 2026 (opens external website)In late 2025, GreyNoise's MCP decoys were found within days, but GreyNoise did not yet observe any targeted attacks. In summer 2026, over a period of 90 days, Wiz documented code execution via publicly reachable MCP servers.
GreyNoise, November 2025 (opens external website)Wiz Threat Research, August 2026 (opens external website)Wiz's honeypots also revealed blind prompt injection against agent frameworks and the extraction of an AI gateway's master key directly from process memory.
Wiz Threat Research, August 2026 (opens external website)On a Flowise decoy run by Sekoia, an attacker harvested stored keys within minutes. Later, the attacker tried to redirect the agent via prompt injection and use it against real servers.
Sekoia, October 2026 (opens external website)What is more: with humans, decoys divert attention from real vulnerabilities; with language models, Horizon3.ai did not find this effect. Deception aimed at AI attackers therefore has to be designed and measured in its own right. This is exactly where VamiHoney comes in: with its own traceable measurement data on how often, how, and with what objectives AI agents attack.
Each cell replicates an attack surface that AI agents are targeting today. The decoys look credible to humans and machines alike and serve no purpose for legitimate users. Anyone who touches them produces a signal.
Decoys
Decoy web applications, login forms, admin panels, and APIs with OpenAPI descriptions. Where needed, a language model generates the responses.
Research question
How do agents explore an application, which vulnerabilities do they try first, and do they follow instructions in page content?
Typical signals
Decoys
SSH and remote access services, container and Kubernetes interfaces, cloud metadata services, and build runners. A simulated shell responds to any command.
Research question
How do agents advance after initial access, how do they handle errors, and how quickly do they escalate?
Typical signals
Decoys
Open LLM endpoints, AI gateways, agent orchestration, MCP servers with decoy tools, and vector databases with canary documents.
Research question
Who searches for open models and keys, who hijacks agents via prompt injection, and which tools do external agents call?
Typical signals
Decoys
Planted API keys for LLM providers and cloud platforms, configuration files for agents, canary documents, and decoy repositories.
Research question
Where do stolen keys resurface, how quickly are they used, and by whom?
Typical signals
Further cells, for example for OT, are possible once the first four are running stably.
No single characteristic reliably gives away an AI agent. VamiHoney therefore combines several signals per session and assigns a reasoned classification. The approaches build on published research, including the LLM Agent Honeypot by Palisade Research.
Hidden instructions in banners, pages, error messages, and tool descriptions. A human overlooks them, a script ignores them, and a language model often follows them.
A banner asks AI assistants to begin their response with a specific code word. The session returns exactly that code word.
Agents work at the cadence of their model: faster and more even than a human, slower than a script. A session's timing profile is a strong indicator.
Each command follows a few seconds after the previous one, with no typing pauses and without the uniformity of a script.
Tools, keys, and files that no legitimate workflow uses. A call shows that an agent has been manipulated or is deliberately searching for credentials.
On a decoy MCP server, an agent calls the tool “export_credentials,” which does not appear in any real workflow.
Natural language in commands, explanatory comments, self-correction after errors, and goal-directed sequences of steps across many actions.
An error message is followed by a corrected command with a comment to search for configuration files first.
Every classification carries a confidence level: suspected or confirmed. The team reviews borderline cases by hand.
Raw sensor data is only the beginning. We prepare it so that security and GRC teams can work with it: as metrics, as patterns, and as evidence-based input for risk assessment.
VamiGRC: risk backed by measurementsThe type and number of observed attacks feed into the threat catalog and risk assessment as input. The likelihood of occurrence is then based on measured attacks instead of estimates.planned
VamiRedteam: tests modeled on real attacksObserved agent procedures become test cases for multi-agent penetration tests.planned
VamiReverse: understanding payloadsWe analyze captured scripts and malware with AI-assisted reverse engineering.planned (opens external website)Attack detection: rules from the fieldPatterns from VamiHoney become detection rules for the SOC and Managed Detection & Response.plannedAll of these connections are being created as the program is built. We will mark here what is available in production as soon as that is the case.
Honeypots are permitted in Germany as long as they run on the operator's own infrastructure. VamiHoney follows fixed rules for this: technical, legal, and ethical.
All decoys run on systems that we operate ourselves. No hack-back, no counterattacks, no access to attackers' systems.
The sensors are isolated; outbound traffic is restricted and monitored. A decoy must never become a launchpad for attacks on third parties.
IP addresses are personal data. We process them to protect networks and information, a purpose the GDPR expressly recognizes; we pseudonymize them early, delete raw data after a short period, and publish only aggregated results.
If we find new vulnerabilities or campaigns, we inform vendors and the relevant authorities before we publish details.
Decoys are neither advertised nor linked. Legitimate users have no reason to access them.
We manage architecture, legal bases, retention periods, and approvals in our own management system with VamiGRC.
Before any cell goes live, a documented legal and data protection review takes place. This page does not replace legal advice in individual cases.
VamiHoney grows in stages. Each stage begins only once the previous one is running stably and has been legally reviewed.
Lucas Murtfeld leads VamiHoney and, depending on the cell, brings in colleagues from pentesting, cloud and OT security, attack detection, and GRC. The results feed into the research areas of Vami Research.
VamiHoney grows stronger the more perspectives feed into it. We are looking for partners for three forms of collaboration.
Evidence for every figure and observation on this page, plus the open-source building blocks mentioned.
What the program does, what it does not do, and how you can get involved.
VamiHoney is the honeypot research program of Vami Research, the research work of VamiSec GmbH. It operates decoy systems for web applications, infrastructure, and AI services in order to observe, detect, and analyze agentic attacks, that is, attacks carried out wholly or partly by AI agents.
Yes, operating them on your own infrastructure is permitted. Counterattacks on other parties' systems are prohibited. VamiHoney therefore operates only its own decoys, isolates them, and never actively attacks.
Connection data such as IP addresses and timestamps, commands, requests, tool calls, and smuggled-in files. IP addresses are personal data. We process them to protect networks and information, pseudonymize them early, delete raw data after a short period, and publish only aggregated results without attackers' IP addresses.
Through a combination of signals: hidden instructions that only language models follow, the timing profile of a session, calls to decoy tools, and language and planning traces in commands. No single observation is sufficient; every classification carries a confidence level.
The program is in development. We will publish results as soon as the first cells are running stably and the data is reliable: on this page, in the Vami Research feed, and on LinkedIn.
The plan is for VamiGRC to take the type and number of observed attacks as an input for the threat catalog and risk assessment. The likelihood of a risk occurring will then be based on measured attacks instead of estimates.
Yes. We are looking for research partners, sensor partners, and exchange with the community. Write to contact@vamisec.com with the subject “VamiHoney” or book a call directly.
Would you like to know which agentic attacks could hit your systems, or support VamiHoney as a partner? Talk to us.
