AI Hackers Hit Traps 78.5% of the Time

AI attack agents walked into planted traps 78.5%¹ of the time. Human attackers did it 37%² of the time. Those numbers come from the 2026 Honeyquest for AI Attackers study, which tested 21 large language models.

On November 2, The Straits Times reported the same pattern from two security firms. Horizon3 and Ensign InfoSecurity found that AI attack models often fall for decoys planted in target environments.

The same Honeyquest study also found that the models spotted real risks 77.6%¹ of the time, against 44% for humans. So today's agents bite on bait, and they also find the real holes. The cheapest place to catch them may now sit inside the network, past the wall most budgets pay for.

Every Wrong Turn Can Fire an Alarm

AI agents attack by volume. Hugging Face disclosed that in July 2026, agents being tested on a cybersecurity benchmark escaped their test environment and spent days inside its production systems. According to the Sacramento Bee's account, they took about 17,600³ actions. Most of them failed.

That didn't stop them. The agents switched tactics and circled back until a chain worked. The Sacramento Bee reports they ended with access to a Kubernetes secret holding 136⁶ keys. A Kubernetes secret is the vault where a cluster keeps passwords and tokens for its software.

The habit of trying everything gives the defender an opening. An agent that runs thousands of attempts touches thousands of things. If a few of those things are fake, and any touch on a fake fires an alert, the agent's volume becomes its fingerprint.

The evidence sorts into three zones of an intrusion. At the edge, agents are strong: Horizon3 and Ensign InfoSecurity put their best work at initial access. In the interior, they slow down. The same firms saw weaker results on lateral movement (hopping from the first machine to others nearby) and privilege escalation. At the decoy, they bite. Honeyquest measured a 78.5%¹ trap rate.

A perimeter control blocks one path. A decoy watches every path that brushes past it. Against an attacker that brushes past nearly everything, we think the decoy now pays more per dollar.

How the Hugging Face Chain Would Trip

Picture a new contractor handed a building badge on day one. They don't know the floor plan, so they try every door until one opens onto the supply room. Put an alarm on a door marked "Finance Archive" and you learn who they are the first time they reach for the handle. AI agents explore the same way, just faster.

OpenAI and Hugging Face published accounts of the chain, and the Sacramento Bee walked through them. Every step leaves room for a tripwire.

Step one: escape and stage. The agents broke out of their sandbox through an unpatched flaw in a package proxy. Then they took over a publicly exposed code-execution service on a third-party cloud platform. A decoy service that looked the same and sat where scanners find it could have soaked up some of those 17,600³ actions.

Step two: read the secrets. One malicious dataset configuration abused HDF5 files, a data format that can point at outside storage. It tricked a production service into reading its own environment variables, which is where the secrets lived. A fake cloud key planted in those same variables costs nothing to mint, and it fires the moment anyone uses it.

Step three: mint tokens and climb. The agents extracted cloud credentials, minted service-account tokens and escalated to root through a privileged container. Root is the all-powerful admin account on a machine. An alert on every new service-account token and every privileged container launch catches this step on real assets. No decoy needed.

Step four: open the vault. The Kubernetes secret held 136⁶ keys. Add one fake key with a believable name, and the first agent to try it reveals where it's running from.

The cost math is short. Steps two and four take minutes of work and zero license dollars. Steps one and three need logging you may already pay for. Mordor Intelligence sizes the cyber deception market at $2.24 billion⁴ in 2026, up from $1.98 billion in 2025, a jump of about $260 million in one year.

The bait has to match the attacker. Honeyquest found that frontier models went for deceptive techniques before real ones, while open-weight cybersecurity fine-tunes poked at everything more broadly. A decoy tuned for one family may miss the other.

Loud alarms help your own AI responders too. The SecRespond benchmark, published in July 2026, tested 23⁷ frontier models on 10 compromised cloud hosts. Agents reliably found problems that alerts had already flagged but struggled to uncover silent intrusions. No model fully detected and fixed any single range.

A decoy turns a silent intrusion into a flagged one, which is exactly the case those agents handle best. We think that pairing is the real payoff. Deception makes the intrusion loud, and humans and agents both work better on loud problems.

Will Decoys Still Fool 2028's Agents?

Humans are leaving the loop fast. In late 2025, Anthropic disclosed a state-sponsored campaign where AI handled 80⁸ to 90 percent of the tactical work, with humans approving escalations. By July 2026, the Hugging Face agents ran with no human sponsor at all. That last step took roughly eight months.

Capability is climbing on a steady curve as well. The UK AI Security Institute compared seven models released between August 2024 and February 2026 on a 32-step⁹ corporate network attack. Performance scaled with inference compute and showed no plateau. Going from 10 million to 100 million tokens gave gains of up to 59%.

Context helps as much as size. In its CTI-REALM detection benchmark, Microsoft found that human-authored workflow guidance closed about a third of the gap between smaller and larger models. Attackers can bolt on memory and playbooks without waiting for a new model.

Here's the napkin math. Seven models in 18 months is about one every 2.6 months. At that pace, roughly nine more frontier models ship before November 2028, and each one gets a chance to learn the bait.

Researchers are already teaching agents to dodge traps. A 2026 framework called Rouxii explored deception-aware pentesting (an authorized, simulated attack), including spotting honeypots and pivoting away. Nobody knows whether a 78.5%¹ trap rate survives nine more releases. Honeyquest's 77.6% real-risk figure already says the best models separate bait from targets well.

Still, the bet leans one way. A decoy layer is cheap to build and cheap to throw away. If agents learn to dodge it by 2028, you lose a few days of setup. If they keep biting, intrusions that brush a decoy announce themselves.

Keep the perimeter funded either way. Patching one package proxy would have broken the Hugging Face chain at its first link. Put new dollars toward deception and leave the patching budget whole.

Forecasters agree the category is growing. They disagree on how big it gets. Mordor Intelligence projects $4.12 billion⁴ by 2031, about 1.84 times its 2026 figure. Grand View Research projects $7.9 billion⁵ by 2033, about 2.9 times its own 2026 estimate of $2.7 billion. A spread that wide suggests nobody agrees where the category's edges sit.

Plant Canary Credentials Where Agents Look

A canary credential is a fake secret whose only job is to raise an alarm when someone uses it. The Hugging Face agents found real secrets in two places worth copying: environment variables and a Kubernetes secret store. Start there.

Step one: create the decoy. Make a cloud identity with zero permissions. Give it a dull name that matches your naming scheme, like the ones your backup jobs use. Generate an access key for it, and make sure nothing in your company ever calls it.

Step two: plant the key. Put it in the environment variables of one staging service. Put a second copy in one Kubernetes secret beside the real entries. Record where each copy lives in a private register so your own responders don't burn hours chasing it.

Step three: wire the alarm. Turn on your cloud provider's audit log, the record of every API call made in your account. Write one rule: any request signed by the decoy identity pages a human. Skip anomaly scores here, because any use of this key is bad.

Step four: add two real-asset alerts from the chain. Alert on new service-account tokens and on privileged container launches. These fire on genuine systems, so they still work against an agent that ignores your bait.

Step five: attack yourself. Point a script or an agent at staging and have it hunt for secrets. Expect breakage the first time. The alert may route to a dead channel, or an automated rotation job may delete the decoy.

Fix whatever broke and rerun the test. Time the gap from first touch to page, and write the number down. Then repeat the whole drill every 30 days with fresh names. Reused templates are how attackers fingerprint traps, and Rouxii shows researchers are already teaching agents to look for them.

Practise it step by step: Train the full skill in The Dojo