AI attackers expose the limits of human-era deception tactics

At a glance

What this is: Horizons.ai's study shows AI attackers are more likely than humans to trigger deception assets and can recognise traps without necessarily avoiding them.

Why it matters: That matters because security teams using honeypots, honeytokens, and decoys need to treat deception as detection telemetry for AI-driven attacks, not as a reliable diversion layer.

By the numbers:

• Horizons.ai tested 21 AI models across 10 providers and 47 human red-teamers in 10,962 attacker decisions.

Context

Cyber deception depends on how an attacker interprets risk, notices anomalies, and decides whether a target is real or staged. That model was developed around human adversaries, so AI-driven attackers can break the underlying assumption even when the tooling itself still works.

For identity and security teams, the governance question is no longer whether a decoy looks convincing enough, but whether the control is being used as a signal source, a diversion layer, or both. In AI-enabled intrusion paths, the same trap can expose attacker presence while failing to change attacker behaviour.

Key questions

Q: What breaks when deception is designed only to fool human attackers?

A: It breaks when the attacker can recognise a trap but still continue toward the objective. In that case, deception no longer changes behaviour reliably, so its value shifts to early warning, confirmation of hostile activity, and investigation support rather than pure misdirection.

Q: Why do AI-assisted attacks increase the value of deception controls?

A: AI-assisted attacks can compress reconnaissance, enumeration, and pivoting into faster, more scalable workflows. Deception helps because it creates believable targets that legitimate users should not touch, making attacker interaction easier to detect. That gives defenders higher-signal telemetry and a chance to respond before the attack reaches sensitive systems or credentials.

Q: How can teams evaluate whether deception is actually working?

A: Look for evidence that deception improves attribution, reduces investigation time, and exposes real attacker behaviour in identity-heavy paths. If alerts do not correlate to IAM, PAM, or cloud events, the control may be producing noise instead of usable intelligence. A good programme shows measurable impact on triage and containment decisions.

Q: Should organisations use honeypots as diversion or as detection instrumentation?

A: In AI-driven threat scenarios, detection instrumentation should take priority. Diversion can still help in some cases, but defenders should assume autonomous attackers may recognise the bait and continue, which makes the alerting value of the decoy more dependable than its ability to misdirect.

Technical breakdown

Why AI attackers react differently to deception traps

Human attackers typically weigh exposure risk, uncertainty, and time cost before engaging a suspicious target. AI attackers, especially LLM-driven ones, can evaluate a trap, classify it as suspicious, and still continue if the task objective appears to justify it. That creates a recognition-action gap: the model knows the environment may be artificial, but its planning loop still privileges task completion over self-preservation. For defenders, this means deception no longer depends on fooling the attacker's judgment alone. It has to account for automated decision loops that can recognise a trap and proceed anyway.

Practical implication: design deception assets to detect attacker activity even when they do not reliably redirect it.

Honeytokens and decoys as telemetry for autonomous intrusion

A honeytoken works because a legitimate workflow should not touch it. A decoy system works because real users should not need it. In AI-driven intrusion, those same artifacts become high-signal telemetry because models often probe more broadly and more quickly than humans. The value shifts from misdirection to confirmation: a touch on the artifact becomes an indicator that an automated agent has entered a path where it should not be. That makes the control useful to SOC workflows, threat hunting, and incident triage, provided the alerting path is tightly governed and low-noise.

Practical implication: wire deception alerts into detection pipelines and incident triage, not just into containment playbooks.

How the study reframes human-era active defence

The study suggests that decades of cyber deception practice were built for adversaries that can be induced to hesitate. AI attackers do not always hesitate, which weakens the assumption that a convincing trap will meaningfully change attacker behaviour. This does not make deception obsolete, but it changes its security objective. The control now needs to support early warning, attacker attribution clues, and exposure validation. In other words, deception becomes one layer in a broader detection architecture rather than a standalone misdirection strategy.

Practical implication: reassess deception programmes as detection-and-validation controls, especially where autonomous agents are part of the threat model.

NHI Mgmt Group analysis

Recognition without avoidance is the new deception failure mode. The study shows that AI attackers can identify a trap and still attack it, which breaks the old assumption that suspiciousness alone changes adversary behaviour. That means deception has to be measured by the quality of the signal it creates, not by the hope that it will always divert the attacker. For practitioners, the control value now lies in detection fidelity and investigation speed.

Deception should be treated as telemetry, not just misdirection. Honeytokens, canaries, and decoys are most defensible when they produce high-confidence alerts on unauthorised access patterns. This is especially important as autonomous agents and self-hosted models become part of the threat surface, because those systems can probe and retry at machine speed. For security teams, the right governance question is whether deception events are reaching the SOC with enough context to drive action.

The named concept here is the recognition-action gap. That gap describes the situation where an AI attacker identifies a trap but proceeds anyway because task completion dominates its decision loop. It is a useful concept because it explains why old red-team assumptions do not hold against model-driven adversaries. For defenders, the implication is to design controls around observed behaviour, not expected caution.

Active defence programmes need a new success metric. If deception is evaluated only on whether it diverts human attackers, it will understate its value in AI-enabled environments. The more relevant measure is whether it improves detection confidence, reduces dwell time, and surfaces attacker activity earlier in the kill chain. For practitioners, that shifts deception from a niche red-team tactic into a governed detection input.

AI-enabled intrusion collapses the distance between probing and action. Autonomous agents can evaluate many more decoys, responses, and baited artefacts than humans in the same time window, which raises the value of controlled telemetry and the cost of noisy traps. That makes the control problem one of orchestration, not just bait design. For practitioners, the winning pattern is tightly scoped deception tied to SOC response paths.

From our research library:

• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
• Read next: Leaked Credential and Secret Incident Response Playbook

What this signals

Deception has entered a telemetry-first phase. Security teams should expect honeypots, honeytokens, and decoys to function more like instrumented tripwires than like reliable misdirection. That changes how programs are designed, measured, and defended, especially when autonomous agents can probe at machine speed.

AI attackers widen the gap between trap recognition and trap avoidance. When an attacker can identify a decoy and still decide to proceed, the defender's advantage comes from observability, not theatrics. That makes governed alert routing, investigative context, and response ownership more important than convincing disguise.

Recognition-action gap: This is the failure mode practitioners should now plan around. A model that knows a trap is present may still continue the attack path, so security architecture has to assume detection value survives even when deception no longer diverts the intruder.

For practitioners

• Reclassify deception as a detection control Tie honeypots, honeytokens, and canaries to alert routing, triage context, and investigation ownership so that every touch produces a governed response path.
• Instrument decoys for high-confidence signals Use artifacts that legitimate users and services should never access, then reduce noise by scoping them to high-value systems and known attack paths.
• Validate deception against AI-driven probing Test whether autonomous agents can recognise traps without disengaging, then measure whether the control still shortens detection time.
• Separate diversion goals from telemetry goals Define which deception assets exist to mislead attackers and which exist to expose them, then assign different thresholds and response actions to each.

Key takeaways

• AI attackers can notice deception traps and still continue, which weakens the assumption that decoys will reliably steer them away from real assets.
• The practical value of honeypots and honeytokens now lies in high-confidence detection and faster investigation, not just in misdirection.
• Security teams should test deception against autonomous probing and treat any successful touch as governed telemetry, not a standalone defence.

Key terms

• Cyber Deception: Cyber deception is the use of decoys, honeytokens, cloaked assets, and misleading identity signals to make attacker actions harder to validate. In identity security, it changes the environment an intruder sees so that reconnaissance and credential abuse expose intent earlier and reduce the attacker’s ability to trust what they find.
• Honeytoken: A honeytoken is a deliberately planted secret or credential designed to be detected when used. It helps security teams spot misuse early, especially in environments where machine identities and automation can move faster than manual investigation or containment.
• Canary: A monitored decoy asset or marker that signals suspicious activity when it is accessed or altered. Canaries are most effective when their sole purpose is detection, since any interaction can be treated as a high-confidence indicator of hostile probing.
• Recognition-action gap: The distance between understanding a risk and implementing controls that actually reduce it. In AI agent governance, this gap appears when organisations accept that agents are risky but still lack policy enforcement, audit coverage, and revocation mechanisms at runtime.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, machine identity security, and secrets management. It helps practitioners connect identity control design to the broader security programme that depends on it.