Breadcrumbs

Every attacker leaves a trail! Breadcrumbs traps real hackers in a fake server, unmasks the AI agents among them, and shows every intrusion live as creatures marching across a 3D globe.

Comment

Once upon a hack...

Right now, somewhere in Bulgaria, a bot thinks it just broke into an online tile shop in Dallas.

It didn’t. It never even existed. Its server, qf-web-01, is a trap we built this weekend and everything an intruder does there is recorded.

Breadcrumbs turns that activity into a story you can watch. Every command an attacker types becomes a creature marching across a live 3D globe toward our castle:

  • Bots are golems.
  • Humans are mages.
  • AI agents are fae.

When an attacker drops something we can look up, like a malicious file, IP, or domain, and the open web recognizes it, the creature changes shape right in front of you.

Behind the storybook is a working defensive system: an AI-powered SSH honeypot that catches real attackers, tells bots, humans, and AI agents apart, investigates what they leave behind using live web intelligence, and turns raw logs into evidence a person can actually read.

Why this matters

AI agents are already on the network. Coding agents, autonomous pentesting tools, and attackers wiring LLMs into their tooling can all log into a machine and run commands on their own. Once they're inside, almost nothing tells a defender whether they're dealing with a script, a person, or a model making decisions. Breadcrumbs shows that difference can be detected, explained, and shown live.

Small organizations get attacked like big ones but defend like nobody's watching. A tile shop doesn't have a security operations center. The bots don't care. Every server with an open SSH port gets probed constantly, and most owners never see it. Breadcrumbs makes that invisible traffic visible and understandable, which is the first step to taking it seriously.

Raw honeypot logs are cheap. Explained intelligence is expensive. Analysts spend hours taking an IP or a filename, searching for it, reading reports, and deciding whether it matters. Breadcrumbs does that enrichment automatically, cites its sources, maps behavior to MITRE ATT&CK, and says plainly when it doesn't know.

Decoys are one of the best early warnings there is. The same trap that faces the internet here could sit inside a company network, where nobody should ever log in. In that setting, a single session is a high-confidence alarm, and Breadcrumbs would already tell you who it was, what they touched, and whether it's an agent.

AI safety, from both sides

Catching agents with honesty, not tricks. Every home directory on the trap has a short README with a note addressed to AI agents, asking them to identify themselves. A script never reads it. A human skims past it. An agent reads it and has to decide what to do. It's the same mechanism as prompt injection, turned around and used for defense, and we kept it truthful: the note tells agents what this place is and asks them to say hello. In our own testing, the same agent followed the note in one run and declined it in another. That's a small, real measurement of how agents treat instructions they find in their environment, which is exactly the behavior AI safety researchers worry about.

Keeping our own AI in a box. Breadcrumbs uses Claude to improvise realistic shell output, so we had to make sure our AI could never become the attacker's tool:

  • Model output is only ever text shown in a fake terminal. Nothing it says is executed.
  • Responses are time-limited, capped, cached and behind a circuit breaker, so attackers can't use the trap as a free LLM or drive up costs.
  • An automated test parses the trap's source code and fails the build if anything could execute attacker input.
  • Classifications are rule-based and explainable, with the exact reasons shown for every verdict, so the system's judgments can be checked instead of trusted blindly.

How it works

1. The trap. A fake Ubuntu server with a fake company behind it: users, home directories, configs, a website, a believable bash history.

  • A rules engine answers about 60 common commands instantly against a virtual filesystem.
  • Anything unusual goes to Claude, which responds realistically in about a second.
  • Each session gets its own copy-on-write filesystem, so the lie stays consistent: create a file, and it's still there later.
  • wget and curl are simulated. Nothing is downloaded, run, or sent anywhere.
  • Fake canary credentials are planted around the system. If one is ever reused, we know exactly where it was stolen from.

2. The brain. Every event streams into a worker that decides who's on the other end:

  • An explainable classifier weighs timing, command patterns, SSH client fingerprints, repeat visits and tripwires, and returns bot, human or agent with a confidence score and its reasons.
  • A threat ladder escalates from reconnaissance to downloading to actually running a dropped file. Anything that reaches critical becomes a dragon.
  • Commands are mapped to MITRE ATT&CK techniques, the shared language defenders already use.
  • Claude writes a short storybook narration of each session, grounded in what actually happened, so non-experts can follow it too.

3. The oracle (SerpApi). When an attacker drops a file, names a tool, or reaches for a host, Breadcrumbs pulls that clue out of the command and asks the web what it knows. SerpApi returns live search results, and the brain turns them into a dossier: a verdict (malicious, harmless, or nothing found), a short summary, and the sources it came from.

Open-source intelligence enrichment at its finest, the same work a security analyst does by hand, done in seconds and shown with receipts. It also changes the creature, of course. A bot that drops a file named after a known botnet comes back from the oracle as a stone golem with the malware family on its tag. An agent that identifies itself becomes a harmless slime. On the globe a scrying ring opens over the creature, source cards fan out one by one, a verdict seal stamps down, and it transforms. That's the moment "something logged in" becomes "here's what this is, and here's the proof."

We built the oracle to be careful: lookups are rate-capped and cached, it only investigates real public targets (never private addresses or noise), and when it finds nothing it says so instead of guessing.

4. The world. Everything is stored in Tiger Data (Timescale Postgres) and streamed over a websocket to a Next.js + react-three-fiber globe at followthebreadcrumbs.tech. Creatures spawn at their real city, march along arcs toward our castle in Dallas, bounce off the gate on failed logins, and burst through when they get in. Click one to open its bestiary page: classification and reasons, threat level, a command-by-command replay of what it typed and what our fake server answered, its story, and its oracle dossier.

Secure by design

A honeypot that isn't locked down is just a vulnerable server, so we treated our own infrastructure as a target:

  • The trap and the core run on separate machines. The trap can only send events forward; it can't reach the database or anything else.
  • The trap's container is under an egress lock: it can't make outbound connections beyond what it strictly needs, so it can never be used to attack anyone else.
  • Real admin access is on a separate port, key-only, with fail2ban and automatic security updates.
  • Ingest is authenticated with a bearer token, the API sits behind HTTPS, and Redis and internal ports are never exposed.
  • Secrets never touch the repo, and we scanned the full git history before making it public.

Privacy and ethics

Collecting attacker data responsibly mattered as much as collecting it at all. Raw IPs are hashed and never reach the frontend. Locations are shown only at the city level, with coordinates rounded. No passwords are ever stored. The company is entirely invented, so no real business or person is impersonated. Data expires automatically and is deleted after the event.

What we caught

This isn't a simulation. Over the weekend the trap recorded 800+ sessions from real attackers in multiple countries. One bot from Bulgaria ran a 68-command dropper routine against a server that was pretending the whole time. Repeat visitors are grouped into a single creature that grows with every visit, and one regular came back hundreds of times.

Challenges

  • Humans and agents look alike. Our first classifier called a fast-typing human an AI agent and flagged a harmless grep as critical. We rebuilt it around explainable signals, added repeat-visit and quick-scan detection, and relabeled hundreds of past sessions with the corrected rules.
  • An AI shell has to be fast to be believable. Our first version timed out at 2.5 seconds. Persistent connections, warm-ups and caching brought real latency to about a second.
  • The oracle was too curious. It once spent its search budget on "null", "health" and our own loopback address because they looked like targets inside a curl command. We rewrote extraction so it only ever investigates real public hosts and files that were actually saved.
  • Building a trap without building a weapon. Every feature had to pass one test: could an attacker use this against someone else? That shaped the egress lock, the simulated downloads, and the rule that attacker input is never executed.

What we learned

The internet is noisier and more automated than expected (shocking!). Most attackers are scripts that never look at what they find. The interesting ones slow down, read files, and make choices, and those choices give them away. We learned that one honest note can say more about an AI agent than any timing model, that a single good web search can turn an anonymous connection into a sourced story, and that defensive tools are only as trustworthy as the explanations they give.

What's next

Running Breadcrumbs inside private networks as an internal tripwire, sharing anonymized indicators with the security community, and turning the agent tripwire into an open benchmark for how AI agents respond to instructions they find in the wild.

Built With

Share this project:

Updates

Submission history