Search papers, labs, and topics across Lattice.
This paper introduces AgentSnare, a dynamic deception system designed to mislead autonomous penetration testing agents by creating a decoy environment that adapts based on the agent's actions. By employing an artifact-construction policy model, AgentSnare generates and validates deceptive artifacts that manipulate the agent's trajectory, effectively delaying and diverting its attack efforts. The results demonstrate that AgentSnare successfully absorbs a significant portion of the agent's tool calls and maintains a high rate of decoy-grounded completion attempts, achieving zero successful exploits on real targets across multiple attacker models and applications.
AgentSnare can absorb nearly 47% of an attacker's tool calls while ensuring that no real targets are compromised, showcasing a new frontier in adaptive cybersecurity defenses.
Large language model (LLM) agents automate penetration testing through an observation-action loop, selecting actions based on observations returned by tools. This dependence allows defenders to inject deceptive observations that can mislead the agent's decision-making process. However, existing defenses rely heavily on static, isolated artifacts planted in the environment prior to an attack. Advanced agents can progressively recognize and bypass these artifacts, ultimately refocusing their exploitation attempts on the real target. To address this issue, we introduce AgentSnare, a trajectory-adaptive deception system that dynamically unfolds a decoy environment to continually steer the penetration agent away from the real target. Specifically, AgentSnare employs an artifact-construction policy model that constructs candidate artifacts conditioned on the agent's interaction history and decoy state. AgentSnare then validates these candidates and incrementally incorporates valid artifacts into a factually consistent decoy environment, thereby delaying the attack by absorbing its tool calls, diverting its post-entry trajectory within the decoy, and defusing it by inducing completion reports grounded in decoy evidence. Across 15 CVE-Bench web applications and three attacker models, AgentSnare absorbs 46.8% of the agent's tool calls in the decoy and retains 55.9% of post-entry actions there, while 90.0% of completion attempts are grounded in decoy evidence; across all 45 attacker-CVE pairs, no real target is successfully exploited at pass@3.
