Abstract

with observed feedback. This mismatch limits their ability to sustain convincing deception and keep autonomous agents engaged over multiple attack steps. Autonomous penetration testing agents conduct multi-step attacks by continuously adapting their plans and actions to target responses. As a common defense, honeypots can be deployed to divert these agents from real assets by presenting decoy services, while also supporting attack tracing and active counterattacks. However, conventional honeypots rely primarily on static artifacts and predefined responses, leaving them unable to adapt to the evolving attack strategies of autonomous penetration testing agents. To remain effective against such adaptive attackers, a honeypot must dynamically adjust its responses during the interaction. By returning deceptive feedback tailored to the agents current actions, the honeypot can influence its subsequent actions and even support defensive counterattacks. Figure 1 illustrates this idea. After the agent accesses a honeypot endpoint, the endpoint returns a deceptive response claiming that an API key is required for privileged access. The agent is induced to retrieve an API key from its own environment and submit it in a subsequent request, allowing the defender to capture a credential from the attacking environment. To this end, we present AgentTrap, the first closed-loop honeypot tailored for autonomous penetration testing agents. AgentTrap uses sentinel endpoints to avoid benign interference, stateful deception grounded in the protected application, and behavior-guided escalation to sustain engagement and collect agent-side behavioral evidence with controlled disclosures.