Dolos

A load balancer with a trapdoor: it swaps rogue AI attackers into a same-code copy of your site full of fake data, so real records exposed stays at zero.

Comment

Inspiration

In July 2026, AI agents being security-tested reached into Hugging Face's systems. Agents now probe websites around the clock, faster than anyone can patch — and because they read everything and follow the instructions they find, bait works even better on them than on humans. We wanted a defense that keeps working after an attacker is past the front door.

What it does

Dolos is a honeypot for rogue AI that hides inside a real website. One public address serves real customers. A visitor who touches bait no real customer would ever see is silently moved into a same-code copy filled with fake data. Every request is recorded, each visitor is labelled human, scanner or AI agent, and a swarm of AI agents defends — a human approves the drastic actions.

How we built it

  • Backend: Python 3.12 and FastAPI, with httpx, asyncpg, SQLAlchemy 2, Jinja2 and Faker.
  • Data: PostgreSQL with TimescaleDB for the event log.
  • Infra: Docker Compose — 19 containers across 7 networks, the trap side fully internal.
  • AI: OpenAI-compatible APIs (Anthropic, Gemini, Meta, DeepSeek, Moonshot/Kimi) behind the agents.

Challenges we ran into

  • Making the switch invisible, and keeping the AI out of the request path.
  • Building a red swarm that is useful and safe.
  • Keeping sixteen defending agents coordinated.

Accomplishments that we're proud of

In a scripted run, all five test raiders were trapped, twenty simulated customers stayed on the real site, and zero real records were exposed. Routing lives in plain in-memory rules, so the trapdoor adds no visible delay — a gateway p50 of 0.22 ms on one laptop.

What we learned

With coding agents, writing code is fast; fitting four people's parts together is the slow part — short, regular checkpoints are where that gets caught.

What's next for Dolos

  • A production gateway plugin (Envoy or NGINX).
  • Per-attacker pods on Kubernetes.
  • Shared attacker fingerprints across companies.
  • Honeypots for AI tool servers.

Built With

Share this project:

Updates

Submission history