Agents are also significantly more intelligent than the types of bots that are generally used to hack systems. The bots are simple automated programs that are executed through scripts, so they fight to adapt to unexpected scenarios. Agents, on the other hand, not only can adapt the way they are involved with a piracy objective, but also to avoid detection, which are beyond the capacities of limited and script programs, says Volkov. “They can look at a goal and guess the best ways to penetrate it,” he says. “That kind of thing is beyond the reach of bots with dumb scripts.”
Since LLM agent, Honeypot, launched in October last year, has registered more than 11 million attempts to access it, the vast majority of which were from human curious and bots. But among these, the researchers have detected eight potential AI agents, two of which have confirmed that they are agents that seem to originate in Hong Kong and Singapore, respectively.
“We assume that these confirmed agents were directly launched experiments with the agenda of something like ‘going to the Internet and trying to hack something interesting for me,” says Volkov. The team plans to expand its Honeypot to social media platforms, websites and databases to attract and capture a broader range of attackers, including spam bots and phishing agents, to analyze future threats.
To determine which visitors of vulnerable servers were agents fed by LLM, the researchers integrated immediate injection techniques in the Honeypot. These attacks are designed to change the behavior of AI agents by issuing new instructions and asking questions that require intelligence in human form. This approach would not work on standard bots.
