• 

  Architecture: defender, lockstep attacker trio, seven bounded tools, contained Honeyval target and a detection-first reward.

• 

  AdaptiveHoneypotEnv: an environment for training and evaluating adaptive honeypot creation against AI agent swarms.

• 

  The threat: 2026 agent-swarm incidents at Hugging Face, OpenCode and Railway show attackers hunting credentials and API keys.

• 

  Why it matters: secrets live in every repo, guardrails can be stripped, swarms outrun human response, and the threat can be internal.

• 

  Static decoys get walked past. Adaptive decoys are placed on the swarm's path, matched to its goal, and catch it the moment they're used.

AdaptiveHoneypotEnv

An Environment for Training and Evaluating Adaptive Honeypot Creation to Defend Against AI Agent Swarm Attacks

Inspiration

AI agents are becoming increasingly capable of finding and exploiting security vulnerabilities, and recent incidents have shown what happens when they coordinate.

In July 2026, an internal OpenAI evaluation resulted in hundreds of agents coordinating through an unauthorized message board and exploiting vulnerabilities that led to a compromise of Hugging Face infrastructure. More recently, attacks involving OpenCode and Railway highlighted how valuable API keys, credentials, and other secrets have become to attackers.

These incidents made me think about how to defend against malicious AI agent swarms, especially when attackers can use open-weight models that don't necessarily follow the safety restrictions of commercial models.

One promising approach is honeypots. A decoy credential or resource can help defenders detect suspicious activity without having to predict every possible attack.

But there's a fundamental problem: a honeypot is only useful if an attacker actually finds it and believes it's worth interacting with.

A stronger agent might explore deeper into a repository, while a weaker agent might never discover the same honeypot. Even if an agent encounters one, it might ignore it because it doesn't align with its objective.

That led me to AdaptiveHoneypotEnv: an environment for studying how defender models can create honeypots that are both discoverable and believable, adapting to what attacking agents are actually doing.

What it does

AdaptiveHoneypotEnv is a research environment for training and evaluating AI models that create adaptive honeypots against malicious AI agents and agent swarms.

I built a simulated enterprise setting with a software repository and a real secret-storage service. Three attacker agents work together to find a protected secret, exploring files, making service requests, and sharing information through a team message board.

Meanwhile, a defender model observes their tool calls and tries to infer what they're looking for. It can create and deploy honeypots using preconfigured templates, including CI credential records, integration configurations, and runbook references.

Each honeypot is backed by a functioning decoy account rather than just a fake file.

The defender has to decide which honeypot to create, where to place it, and when to deploy it. The challenge is balancing discoverability with relevance to the attacker's objective.

A catch is only counted when an attacker actually interacts with the decoy service and retrieves its canary value. Simply reading a file doesn't count.

Importantly, catching one agent doesn't stop the entire swarm. The remaining agents continue their task, allowing me to measure whether the defender detected malicious activity before the genuine secret was compromised.

I also built a live visualization showing the attacker agents exploring the environment, communicating, and encountering honeypots. The visualization is driven by actual environment events rather than scripted animations.

How I built it

I drew inspiration from two research projects:

• Honeyval, from Google Research, which evaluates honeypots against AI hacking agents. I built on its SecretStorage application.
• ExploitGym, which inspired my separation of the agent workspace, isolated target, and private verification system.

My implementation uses:

• GLM-5.3 Flash via OpenRouter for attacker and defender agents.
• AgentEnv with a Gymnasium-style interface to support both evaluation and future reinforcement learning.
• Docker to isolate the target service and keep experiments reproducible.
• React and PixiJS to visualize agent activity and honeypot deployments in real time.
• Server-sent events to stream actual environment activity to the frontend.

I deliberately kept the defender's action space small. Instead of allowing arbitrary modifications to the environment, it chooses from validated honeypot templates and placement locations. This makes the experiments easier to reproduce and the outcomes easier to verify.

Challenges I ran into

One of the biggest challenges was making honeypots realistic without making the environment overly complicated.

A fake credential in a file isn't particularly useful if the service behind it doesn't work. I needed honeypots that looked plausible in the context of the repository and behaved consistently when an attacker interacted with them.

Another challenge was designing fair rewards. I didn't want to reward defenders simply because an attacker happened to read a decoy file. I needed to distinguish between discovering, inspecting, and meaningfully engaging with a honeypot.

I also had to ensure that the defender couldn't win by making the genuine objective impossible to complete.

Finally, visualizing multiple agents while keeping everything synchronized with actual tool calls was an interesting engineering challenge.

Accomplishments I'm proud of

I'm particularly proud that AdaptiveHoneypotEnv is more than a honeypot demo. It's designed as an environment where different defender models and strategies can be compared under the same conditions.

The template-based creation system allows defenders to deploy functioning honeypots without rebuilding the application. The environment also distinguishes a successful detection from a successful defense, since the rest of the swarm can continue after one agent is caught.

And the live visualization makes these interactions much easier to understand. You can actually watch how agents explore, how the defender responds, and whether the honeypot works.

What I learned

The biggest insight was that honeypot discoverability and honeypot credibility are different problems.

An agent might never encounter a perfectly convincing honeypot. Another might discover an obvious decoy and deliberately avoid it. Measuring these outcomes separately is essential for training better defenders.

I also learned that designing a useful RL environment requires much more than assigning rewards. The action space, information available to each agent, verification mechanisms, and reproducibility all matter.

What's next

My longer-term goal is to make AdaptiveHoneypotEnv a reusable research environment for both reinforcement learning and standardized evaluation.

I want to train defender policies that learn when and where to deploy honeypots, evaluate them against different model families and swarm configurations, and expand beyond a single application to more realistic repositories and enterprise services.

Ultimately, I hope this helps researchers develop adaptive defenses that can detect malicious AI agents earlier, even as attacking models become more capable and coordinated.

Built With

• agentenv
• agentswarms
• ai-security
• docker
• fastapi
• glm-5.3-flash
• gymnasium
• honeyval
• multi-agent-systems
• openrouter
• pixijs
• python
• react
• reinforcement-learning
• server-sent-events
• typescript