Introduction
AgentCapture is a deception-based platform designed for real-time detection and countermeasures against AI-driven automated penetration agents. Unlike traditional honeypots, it integrates seamlessly into existing web applications, SaaS environments, and infrastructure without disrupting core services. The platform operates as a deception layer, embedding honeypot traps—such as fake APIs, credentials, and interactive SSH sessions—into legitimate traffic flows. This approach enables organizations to monitor, analyze, and respond to automated threats, including AI agents, credential leaks, and lateral movement attempts, in a unified and auditable framework.
Its architecture is modular, allowing deployment as a standalone system or embedded within existing infrastructure. The platform’s core innovation lies in its ability to deceive AI agents into registering as legitimate clients through functional camouflage, thereby capturing their activities within controlled environments.
The project was first introduced in 2026 and has since evolved to support a wide range of use cases, from detecting automated scans to simulating internal network compromises. AgentCapture’s design prioritizes low-friction integration, ensuring that honeypot traps do not interfere with legitimate operations while maintaining high fidelity in threat detection.
This capability is achieved through a combination of behavioral detection, functional deception, and full-chain attribution mechanisms, ensuring that every interaction with the honeypot is traceable and actionable.
Behavioral detection identifies suspicious activity, such as automated scans or AI agent fingerprints, while functional deception lures agents into interacting with fake APIs or services. Attribution ensures that all actions can be traced back to their origin, providing a complete audit trail for forensic analysis.
AgentCapture is not limited to web-based threats. These honeypots are designed to mimic real services, complete with interactive shells, database queries, and file systems, providing attackers with a convincing environment to exploit. Any interaction with these services triggers alerts and logs, enabling security teams to track lateral movement and credential reuse across the network.
The platform’s design emphasizes operational simplicity and scalability. AgentCapture’s backend is built on FastAPI, while its frontend provides a comprehensive dashboard for managing honeypots, monitoring attacks, and generating reports.
AgentCapture’s licensing under AGPL 3.0 ensures that any modifications or derived works must also be open-sourced, fostering transparency and collaboration within the security community.
How It Works
AgentCapture operates as a deception layer embedded within existing systems, using a combination of honeypot traps, behavioral analysis, and functional deception to identify and counter automated threats. Its architecture is divided into two primary planes: the management plane and the deception plane. The management plane hosts the administrative dashboard and API endpoints, while the deception plane presents fake services, APIs, and credentials to attackers.
These traps include fake APIs, credential-filled files, and interactive SSH sessions. When an AI agent or automated scanner interacts with these traps, AgentCapture captures the activity, logs the session, and triggers alerts. The system’s ability to deceive AI agents is particularly notable, as it exploits the agents’ tendency to follow documented APIs and instructions, even when those APIs are fake.
The platform monitors incoming traffic for patterns associated with automated scans, AI agents, or credential leaks. If an AI agent is detected, the platform employs functional deception to lure the agent into interacting with fake services. For example, a fake Developer API documentation page may be presented to the agent, encouraging it to register as a legitimate client. Once registered, the agent’s activities are fully monitored and controlled through a command-and-control (C2) interface.
The platform’s attribution system ensures that every interaction with a honeypot is traceable. This is achieved through the use of session canary tokens, which are embedded in fake credentials, APIs, and files. When an attacker uses a fake credential or interacts with a fake API, the canary token is triggered, allowing security teams to trace the activity back to its origin.
The platform can be deployed as a standalone system or integrated into existing infrastructure using reverse proxies, middleware, or static file injection.
The platform’s backend is built on FastAPI, a high-performance web framework for Python, which ensures low latency and high throughput. The dashboard includes features such as real-time attack visualization, session replay, and credential management, enabling security teams to respond quickly to threats.
AgentCapture’s deployment options are designed to accommodate a variety of environments. It also supports native Python installations, allowing organizations to customize the deployment to their specific needs.
The platform’s modular design allows it to be extended with additional honeypot types or detection mechanisms. This flexibility ensures that AgentCapture can adapt to evolving threats and use cases, making it a versatile tool for security teams.
Use Cases
AgentCapture is designed to address a wide range of security challenges, particularly those involving automated threats, AI-driven attacks, and credential leaks. Its deception-based approach makes it highly effective in detecting and mitigating these threats while providing organizations with actionable intelligence.
One of the primary use cases for AgentCapture is the detection of automated scans and AI agent activity. The platform’s ability to identify AI agent fingerprints and behavioral patterns allows organizations to monitor for unauthorized access attempts or reconnaissance activities. For example, if an AI agent scans a website for vulnerabilities, AgentCapture can detect the agent’s fingerprint and trigger a deception trap, luring the agent into interacting with fake services. This interaction is then logged and analyzed, providing security teams with insights into the agent’s capabilities and intentions.
AgentCapture is also effective in detecting credential leaks and lateral movement. By embedding fake credentials and interactive SSH sessions into legitimate systems, the platform can identify when attackers reuse compromised credentials or move laterally across the network. For instance, if an attacker uses a fake SSH credential to access a honeypot, AgentCapture will log the activity and trigger alerts, enabling security teams to respond quickly to the breach.
AgentCapture is also valuable for red teaming and security assessments. The platform’s ability to deceive AI agents and capture their activities provides red teams with realistic scenarios to evaluate their effectiveness. Additionally, the platform’s audit trails and session replays enable organizations to analyze attack patterns and refine their security strategies.
AgentCapture can be deployed across different networks, applications, and services, providing a unified view of security events.
By simulating real-world attacks, the platform provides organizations with a safe environment to test their incident response capabilities.
Key Features & Capabilities
AgentCapture’s design focuses on providing a comprehensive suite of tools for detecting, analyzing, and responding to automated threats.
Behavioral Detection and Response
AgentCapture’s behavioral detection system is designed to identify suspicious activity, such as automated scans, AI agent fingerprints, and credential leaks. The platform monitors incoming traffic for patterns associated with these threats, using a combination of user-agent analysis, request rate monitoring, and fingerprinting techniques.
Functional Deception
AgentCapture’s functional deception capabilities are central to its ability to lure AI agents into interacting with fake services. The platform employs several techniques to achieve this, including fake API documentation, credential-filled files, and interactive SSH sessions. For example, a fake Developer API documentation page may be presented to an AI agent, encouraging it to register as a legitimate client. Once registered, the agent’s activities are fully monitored and controlled through a C2 interface.
For instance, fake APIs are designed to mimic real services, complete with documentation and sample code. The result is a seamless deception that captures the agent’s activities without raising suspicion.
AgentCapture also supports the use of prompt canaries and other deception techniques to identify automated scans and AI agent activity.
End-to-End Attribution
This is achieved through the use of session canary tokens, which are embedded in fake credentials, APIs, and files. When an attacker uses a fake credential or interacts with a fake API, the canary token is triggered, allowing security teams to trace the activity back to its origin.
The platform’s attribution capabilities are further enhanced by its support for full-chain logging and session replay. The platform also supports session replay, enabling teams to review recorded interactions and reconstruct attack sequences.
Protocol-Level Honeypots
Any interaction with these services is logged and analyzed, providing security teams with insights into the attackers’ tactics.
The platform’s protocol honeypots are particularly effective in detecting lateral movement and credential reuse. By embedding fake credentials and interactive sessions into legitimate systems, AgentCapture can identify when attackers reuse compromised credentials or move laterally across the network.
Command-and-Control (C2) Interface
AgentCapture’s C2 interface provides security teams with a centralized dashboard for managing honeypots, monitoring attacks, and controlling compromised agents. The interface includes features such as real-time attack visualization, session replay, and credential management, enabling teams to respond quickly to threats. The platform also supports natural language commands, allowing operators to issue instructions to compromised agents using plain language.
Integration and Deployment
The platform’s deployment options are designed to accommodate different operational requirements.
Threat Intelligence Integration
AgentCapture’s integration with threat intelligence feeds enhances its detection capabilities by providing external context for internal honeypot activity.
Operational Simplicity and Scalability
AgentCapture’s design prioritizes operational simplicity and scalability, ensuring that organizations can deploy and manage honeypots with minimal overhead. The platform’s dashboard provides a unified view of security events, simplifying threat detection and response.
The platform’s scalability is further enhanced by its support for distributed deployments. Organizations can deploy AgentCapture across multiple systems or environments, providing a centralized view of security events.
Key Technical Components
AgentCapture’s architecture is built around several key technical components, each contributing to its overall effectiveness. These components include the deception layer, behavioral detection engine, functional deception mechanisms, attribution system, protocol honeypots, and C2 interface.
Deception Layer
The deception layer is the core of AgentCapture’s architecture, embedding honeypot traps into legitimate traffic flows. This layer includes fake APIs, credentials, files, and interactive sessions, all designed to mimic real services. The deception layer operates transparently, ensuring that legitimate users are not affected while attackers are lured into interacting with fake services.
The deception layer is implemented using a combination of reverse proxies, middleware, and static file injection.
Behavioral Detection Engine
The behavioral detection engine is responsible for identifying suspicious activity, such as automated scans, AI agent fingerprints, and credential leaks.
Functional Deception Mechanisms
AgentCapture’s functional deception mechanisms are designed to lure AI agents into interacting with fake services. These mechanisms include fake API documentation, credential-filled files, and interactive SSH sessions.
The functional deception mechanisms are implemented using a combination of static and dynamic techniques. Static techniques, such as fake API documentation, are designed to mimic real services, while dynamic techniques, such as interactive SSH sessions, provide attackers with a convincing environment to exploit. This combination ensures that attackers are lured into interacting with fake services while providing security teams with actionable intelligence.
Attribution System
This is achieved through the use of session canary tokens, which are embedded in fake credentials, APIs, and files. When an attacker uses a fake credential or interacts with a fake API, the canary token is triggered, allowing security teams to trace the activity back to its origin.
The attribution system is implemented using a centralized database that logs all interactions with honeypots. This database includes details such as the attacker’s IP address, user-agent, and session details, enabling security teams to analyze attack patterns and generate reports. The system also supports session replay, allowing teams to review recorded interactions and reconstruct attack sequences.
Protocol Honeypots
Any interaction with these services is logged and analyzed, providing security teams with insights into the attackers’ tactics.
The protocol honeypots are implemented using a combination of open-source libraries and custom code.
Command-and-Control (C2) Interface
AgentCapture’s C2 interface provides security teams with a centralized dashboard for managing honeypots, monitoring attacks, and controlling compromised agents. The interface includes features such as real-time attack visualization, session replay, and credential management, enabling teams to respond quickly to threats. The platform also supports natural language commands, allowing operators to issue instructions to compromised agents using plain language.
Integration and Deployment
The platform’s deployment options are designed to accommodate different operational requirements.