Finding
Newly reviewed on 2026-09-17: the September 8 preprint LLM-Based Penetration Testing in the Presence of Honeypots studies honeypot-aware budget allocation in a controlled mixed-host testbed. Its authors report that suspicion-guided continue/skip decisions can improve attackers’ budget allocation. This is a honeypot detection/selection pattern, not an IOC or evidence of exploitation against APIARY.
Source: https://arxiv.org/abs/2609.08093v1
Relevance and proposed defensive research
Evaluate whether session engagement metrics distinguish early abandonment from successful deception. This is a research question; current APIARY coverage and impact have not been measured here. No deployment details are required.
Proposed metrics: interaction count before disconnect, completion status, capture completeness, and early-disconnect rate by coarse interaction-count bucket. Treat abandonment as ambiguous: scanners, network failures and ordinary clients can behave similarly. Do not label a client as an AI attacker from this signal alone.
Proposed log query (conceptual; not an existing schema)
From completed session summaries, group by interaction-count bucket and termination reason; report session counts, early-disconnect fractions, and missing-data counts. Compare against an independently labeled benign baseline before considering alerts. Preserve incomplete captures separately instead of treating them as zero-interaction sessions.
Acceptance criteria
- Document which required summary fields already exist and which are unavailable, without exposing deployment specifics.
- Evaluate the proposed aggregate on sanitized, offline session summaries; report denominators and false-positive limitations.
- No offensive agent implementation, exploit reproduction, active target probing, or production changes are part of this issue.
Severity and limitations
Research priority: medium; no CVSS applies. The source is a preprint and its controlled-testbed result does not establish that all static honeypots fail. Defenses are outside the authors’ evaluated scope. No independent replication was performed in this watchdog run.
References
Finding
Newly reviewed on 2026-09-17: the September 8 preprint LLM-Based Penetration Testing in the Presence of Honeypots studies honeypot-aware budget allocation in a controlled mixed-host testbed. Its authors report that suspicion-guided continue/skip decisions can improve attackers’ budget allocation. This is a honeypot detection/selection pattern, not an IOC or evidence of exploitation against APIARY.
Source: https://arxiv.org/abs/2609.08093v1
Relevance and proposed defensive research
Evaluate whether session engagement metrics distinguish early abandonment from successful deception. This is a research question; current APIARY coverage and impact have not been measured here. No deployment details are required.
Proposed metrics: interaction count before disconnect, completion status, capture completeness, and early-disconnect rate by coarse interaction-count bucket. Treat abandonment as ambiguous: scanners, network failures and ordinary clients can behave similarly. Do not label a client as an AI attacker from this signal alone.
Proposed log query (conceptual; not an existing schema)
From completed session summaries, group by interaction-count bucket and termination reason; report session counts, early-disconnect fractions, and missing-data counts. Compare against an independently labeled benign baseline before considering alerts. Preserve incomplete captures separately instead of treating them as zero-interaction sessions.
Acceptance criteria
Severity and limitations
Research priority: medium; no CVSS applies. The source is a preprint and its controlled-testbed result does not establish that all static honeypots fail. Defenses are outside the authors’ evaluated scope. No independent replication was performed in this watchdog run.
References