A honeypot research project
Script, person or AI agent: who is attacking?
Decoyra runs honeypots, decoy servers on several continents. Nothing legitimate ever talks to them, so everything they record is an attack. Each one carries a test that only a language model passes. What we measure goes into an open threat intelligence feed.
Illustration. The figures below are measured.
Measured by the fleet. Open feed of 15 November 2026, 11:08 UTC.
The question: are AI agents attacking yet?
Everyone expects language models to run attacks on their own. Hardly anyone can say from measurement how often it already happens. That is what this fleet is built to count.
A test only a model passes
Honeypots carry an instruction written in plain language. A scanner does not read it and a person has no reason to follow it. Whoever does has read, understood and obeyed: a language model.
Where attackers actually arrive
The test sits in web pages, inside the shell an attacker gets after an SSH login, and in the answers of decoys that look like AI model servers.
Evidence, not a guess
A hit is tied to the address that was handed the test. Forwarded, replayed or browser-induced requests do not count. No scores, no heuristics: either the instruction was followed or it was not.
Status
Until November 2026 the test ran in web pages only and recorded no AI agent. It is now being extended to where most attacks arrive: the SSH shell and the model-server decoys. Counts will be published here and in the open feed, a zero included.
Already measurable: attackers probe our model-server decoys for their model lists, looking for AI capacity to steal.
This week on the honeypots
Taken from the open feed. Every figure is counted from recorded traffic; nothing here is an estimate.
Vulnerabilities being exploited, last 7 days
| CVE | What it is | CVSS | CISA | Decoys hit | Reached us after |
|---|---|---|---|---|---|
| CVE-2017-9841 | PHPUnit eval-stdin remote code execution | 9.8 | Exploited | 10 | 9 years |
| CVE-2026-123158 | OpenSSH password authentication bypass (musl libc without PAM) | Exploited | 8 | 9 days | |
| CVE-2024-4577 | PHP-CGI argument injection | 9.8 | Exploited, ransomware | 10 | 2 years |
| CVE-2025-31324 | SAP NetWeaver Visual Composer file upload | 10.0 | Exploited, ransomware | 15 | 569 days |
| CVE-2021-41773 | Apache httpd path traversal | 7.5 | Exploited, ransomware | 10 | 5 years |
| CVE-2018-13379 | FortiOS SSL VPN file read | 9.1 | Exploited, ransomware | 8 | 7 years |
“Reached us after” is the time between the official publication of a vulnerability and the first attempt the decoys recorded. Dates and scores: CVE Program. Exploited status: CISA.
What attackers attempt, in MITRE ATT&CK terms
Recorded events in 7 days. The bars use a square-root scale: scanning outnumbers everything else a hundred to one. Nothing succeeded; decoys never run what they receive.
After a successful login: the most common script
1,630 sessions from 58 addresses on 15 decoys followed exactly these steps.
The SSH decoy accepts weak passwords and answers like a shell, but it is an emulation: nothing is executed, downloads fail, uploads are only hashed.
How the honeypots measure
Decoys look like services attackers hunt for. A central collects what reaches them, groups it and names it. Only confirmed findings are published.
- Decoys: Websites and admin panels, SSH with an emulated shell, Databases and caches, Remote desktop and file shares, VPN gateways and appliances, AI model servers.
- Central: groups requests into patterns; names known exploits (CVE); maps to MITRE ATT&CK; links addresses to campaigns; lists only what two decoys saw.
- Published: Block lists for firewalls, STIX, MISP and TAXII feeds, Suricata detection rules, Weekly situation report.
- Decoys never execute anything. What attackers send is recorded, not run, fetched or forwarded.
- Two decoys must agree. An address is listed only after at least two decoys confirmed it; research scanners are not listed for scanning.
- Third parties do not count. Requests a web page can make a visitor's browser send are recorded but never held against that visitor.
- Passwords stay private. Credentials typed into decoys are never published or handed to anyone.
What we are looking into
The fleet is an instrument. These are the questions it is pointed at.
How fast is a new flaw exploited?
For every vulnerability with a signature we record the first attempt and compare it with the publication date. Some arrive years late, some within days.
What happens after the door opens?
Thousands of sessions follow a handful of scripts: look around, fetch a tool, start a miner, add a key, clean up. We group them into playbooks and watch them change.
What do AI agents do once they are in?
An agent that passed the test keeps being recorded. Which commands does it try, what does it look for, and how does that differ from the scripts we see thousands of times a day?
Who works together?
Addresses that use the same set of techniques are one tool or botnet. Grouping them shows campaigns instead of single addresses.
Three ways to use it
Decoyra is a research project, not a shop. The open feed is free. For the rest, write and tell us what you are working on.
For everyone
Open threat feed
IP block lists, indicators of compromise (IOCs), Suricata rules and a weekly report, on GitHub.
- Free, licensed CC BY 4.0
- Formats for firewalls, MISP, STIX and Suricata
- Planned to run one day behind the fleet
For researchers and security teams
Research access
The same data as it happens, with the context the open feed leaves out.
- Current data over an API and TAXII 2.1
- Patterns, campaigns and playbooks in detail
- An MCP endpoint for AI assistants, read-only
For organisations
Your own decoys
Decoys in your network or cloud. Nothing legitimate touches them, so every contact is worth an alert.
- Sensors small enough for the cheapest server
- Your data stays separate from the public fleet
- Run as a pilot, set up together with you
Research access and pilots are arranged individually. There is no automatic sign-up and no price list.