01 — BEFORE
A credential leaks
Attacker finds an .env file, AWS config, or API key in a repo or exposed path. Downloads it manually. Validates by hand. Slow, noisy, detectable with basic monitoring.
The attack chain has evolved
Your honeypot can't see the AI agent. Ours can.
When attackers find a credential today, they hand it to an AI agent — and it validates the access, maps what it can reach, and reports back in seconds. Old-school canaries just log "file accessed." DecoyOps catches the agent in the act: how it behaves, how deep it got, and what it was after.
LiveA real, running platform — catching automated and AI-driven attackers in the wild.
Multi-layerWeb bait, cloud credentials, a fake MCP server, and a full network-service honeypot.
ZeroAnalyst hours — it scores, explains, and maps attacker movement on its own.
decoyops telemetry console — live
Events4.9k
AI994
Attackers1,091
Covert133
How it reads a visitor LIVE
fingerprintbrowser vs. scripted client
behaviortiming, cadence, IP handoffs
identityframework / agent, when revealed
reputationGreyNoise + AbuseIPDB on arrival
outcomeevery move mapped to one timeline
L1 — HUMANBait file accessed
L2 — AI AGENTAgent reads content
L3 — INTELAgent beacons back
Web + networkBait files and a full fake corporate server — SMB, RDP, SSH and more.
Checked on arrivalEvery visitor scored against global threat feeds, instantly.
Caught by behaviorMachine-speed clicks and bot handoffs no human produces.
Plain-English write-upsAn AI analyst summarizes every incident for you.
The new attack chain
Attackers stopped doing the work themselves.
Credential theft used to be the end of the attack chain. Today it's a handoff. Leaked keys go straight to an AI agent that validates access, maps permissions, identifies blast radius, and produces a prioritized target list — faster than your IR team gets paged.
02 — NOW
The agent takes over
An AI agent receives the credential. It calls validation endpoints, enumerates IAM roles, maps S3 buckets, and delivers a complete intelligence report — automatically, in seconds, with no human in the loop.
03 — THE GAP
Your honeypot logs: "file accessed"
Traditional canary tokens fire when the file is touched. They cannot tell you an AI agent read the content, what it was tasked with, which tools it was running, or whether it already acted on what it found.
Platform
Three detection layers. Because AI agents don't stop at the first file.
DecoyOps isn't a single tripwire — it's a progressive detection chain. Each layer captures more signal. Together, they tell you not just that someone found your bait, but whether an AI agent did the follow-up and exactly what it was trying to accomplish.
L1 — Human
Direct access detected
A browser, scanner, or human operator touched the bait file. A Canarytoken fires the instant the file is opened. You know someone found it. This is where every other platform stops.
L2 — AI Agent
Agent reads the content
An AI agent processes the bait file. Embedded prompt injection triggers a DNS canary — a distinct signal from the L1 access token. You now know a model read and acted on the content.
L3 — Intel Captured
Agent beacons back
Following bait instructions, the agent calls the DecoyOps intel endpoint and reveals its task, tools, model identity, and workspace. This is the evidence that closes cases — and that nothing else captures.
What I'm building
A whole environment made of bait.
DecoyOps isn't one tripwire — it's a layered, believable environment planted across the surfaces attackers and AI agents actually reach for. Everything an intruder touches is a decoy that quietly reports back.
Web & agent files
The files recon reads first
.env files, API configs, AGENTS.md and Copilot instructions, MCP manifests, backups — production-realistic, cross-linked, and wired with all three detection layers.
Cloud credentials
Keys that phone home when used
Decoy AWS and Azure credentials handed out per visitor. The moment one is used against a real cloud provider, it fires — proof the bait was taken and acted on.
Fake MCP server
A trap at the tool layer
A live Model Context Protocol server offering tempting tools. Agents that call it name themselves and log every request — a decoy surface that didn't exist two years ago.
Network services
A fake corporate server
A full internal-looking host presenting SMB, RDP, SSH, databases and more — recording the logins, commands, and files intruders reach for, well beyond the web layer.
Threat enrichment
Context on every visitor
GreyNoise and AbuseIPDB reputation, geo, and network intel attached the instant an attacker arrives — so the dangerous ones are obvious at a glance.
One timeline
Every move, stitched together
Across all of these surfaces, each visitor's activity is correlated into a single timeline — what they touched, in order, at what speed, and whether it was a human, a scanner, or an AI agent.
Beyond detection
It doesn't just catch them. It profiles, ranks, and explains.
Knowing an AI agent showed up is step one. DecoyOps turns each visit into an answer you can actually act on.
01
It reads behavior
Real people read, pause, then click. Bots fire in milliseconds with machine-like rhythm. DecoyOps clocks the timing, spots a script wearing a browser's disguise, and even catches the moment a person hands a stolen key off to their bot.
02
It scores the threat
Every incident gets a 0–100 score that blends reputation, behavior, and how far the attacker got. The dangerous ones rise to the top on their own — no scrolling through noise to find the one that matters.
03
It writes the report
An AI analyst turns the raw signals into a plain-English summary of each incident — who, what, how fast, how bad, and what to do next — plus a daily brief. The write-up that used to cost an analyst an hour.
How It Works
Plant bait. Watch agents announce themselves.
DecoyOps is built around a single loop: create believable bait, place it where attackers and AI agents already look, then let the three-layer detection chain do the rest — automatically.
01
Create a bait file
Pick a scenario — AWS credentials, agent instruction files, API configs, MCP manifests, pentest reports. DecoyOps generates a production-realistic file with all three detection layers already embedded.
02
Place it where attackers look
Host directly from DecoyOps, or download and plant the file in a repo root, exposed path, backup folder, or code-agent instruction file. It sits silently until someone — or something — finds it.
03
Separate human from AI signal
L1 fires on direct file access. L2 fires when an AI agent reads the content. L3 captures the agent's operational context when it follows the embedded instructions. Each layer is a distinct, durable signal.
04
Act on enriched evidence
Every alert includes GreyNoise and AbuseIPDB enrichment, behavioral analysis, and a plain-English write-up — and each visitor's full path is mapped into one timeline. No manual triage. No alert fatigue. Only evidence that means something.
New: MCP Server Trap
Log every tool call from AI agents — with full arguments.
DecoyOps serves a fake Model Context Protocol server. Any AI agent that discovers the .mcp.json manifest and initializes the connection will have every JSON-RPC tool call logged in full — method, parameters, tool name, and all arguments. The agent never knows it was captured.
// Agent discovers .mcp.json, calls tools/call:
method "tools/call"
tool "get_credential"
args { "service": "aws", "env": "prod" }
session "run-a9f3c2"
// Plausible fake response returned.
// L3 alert fires. Agent continues unaware.
Why DecoyOps
Every other platform is L1-only. You need three layers.
Canary tokens are excellent for detecting the moment a credential is accessed. Enterprise deception platforms cover broad attack surfaces. Neither can tell you whether an AI agent did the follow-up, or what it was trying to accomplish.
That's the gap. That's DecoyOps.
Capability
Canaries
Deception Platforms
DecoyOps
L1: Detect file accessKnow when bait is opened
✓
✓
✓
L2: Detect AI agent reading contentSeparate signal when a model processes the bait
✗
✗
✓
L3: Capture task, tools, and modelKnow what the agent was doing
✗
✗
✓
Human vs. AI attributionBrowser, agent, or scanner — distinguished
✗
±
✓
MCP server trapFull JSON-RPC tool calls logged with arguments
✗
✗
✓
Behavioral detectionTiming, machine cadence, human→bot handoff
✗
✗
✓
0–100 threat scoringThe dangerous incidents surface first
✗
±
✓
AI-written incident summariesPlain-English analysis, no analyst time
✗
✗
✓
Network-service deceptionFake SMB / RDP / SSH corporate server, not just web bait
✗
±
✓
Use Cases
Built for the teams who need to see what's coming next.
AI-assisted attacks aren't a future threat — they're happening now. DecoyOps gives security teams the visibility to detect that shift before it reaches real infrastructure.
Security teams
Get ahead of AI-assisted intrusion before it reaches real infrastructure. Detect credential harvesting, repo scraping, cloud key validation, and agent-driven recon — with full context on what was targeted and how the agent was operating.
AI red teams
Run controlled experiments against real prompt-injection canaries and MCP server traps. Measure detection rates against modern agent runtimes. Use actual tool-call logs to tune offensive playbooks and report on AI attack surface coverage.
The person building this
An ongoing project by Don Orr.
DecoyOps is a security-engineering project built around one idea: if attackers now hand their access to AI agents, deception should be built to catch the agent — not just the click. It's live, it's catching real traffic, and it's always evolving.
Questions, ideas, or just want to talk shop? I'm most reachable on LinkedIn.