Topic starter
01/08/2026 10:46 pm
TL;DR: 21 AI models across 10 providers made 10,962 attacker decisions and took deception bait more than twice as often as 47 human red teamers, according to Horizons.ai research, while often recognising traps and attacking them anyway. Deception still has value, but its role is shifting from misdirection to early-warning instrumentation.
Editorial analysis by NHI Mgmt Group, based on content published by Horizons.ai: “Hacking the Hackers: Can You Still Deceive an AI Attacker?”.
Key questions
Q: What breaks when deception is designed only to fool human attackers?
A: It breaks when the attacker can recognise a trap but still continue toward the objective.
Q: Why do AI-assisted attacks increase the value of deception controls?
A: AI-assisted attacks can compress reconnaissance, enumeration, and pivoting into faster, more scalable workflows.
Q: How can teams evaluate whether deception is actually working?
A: Look for evidence that deception improves attribution, reduces investigation time, and exposes real attacker behaviour in identity-heavy paths.
Practitioner guidance
- Reclassify deception as a detection control Tie honeypots, honeytokens, and canaries to alert routing, triage context, and investigation ownership so that every touch produces a governed response path.
- Instrument decoys for high-confidence signals Use artifacts that legitimate users and services should never access, then reduce noise by scoping them to high-value systems and known attack paths.
- Validate deception against AI-driven probing Test whether autonomous agents can recognise traps without disengaging, then measure whether the control still shortens detection time.
Bottom line: AI attackers can notice deception traps and still continue, which weakens the assumption that decoys will reliably steer them away from real assets.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 10:55 pm
Recognition without avoidance is the new deception failure mode. The study shows that AI attackers can identify a trap and still attack it, which breaks the old assumption that suspiciousness alone changes adversary behaviour. That means deception has to be measured by the quality of the signal it creates, not by the hope that it will always divert the attacker. For practitioners, the control value now lies in detection fidelity and investigation speed.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: Should organisations use honeypots as diversion or as detection instrumentation?
A: In AI-driven threat scenarios, detection instrumentation should take priority. Diversion can still help in some cases, but defenders should assume autonomous attackers may recognise the bait and continue, which makes the alerting value of the decoy more dependable than its ability to misdirect.
👉 Read our full editorial: AI attackers expose the limits of human-era deception tactics