A team from Horizon3.ai recently published a pre-print – “Honeyquest for LLMs: Rethinking Cyber Deception for AI Attackers” on arXiv. They wanted to know if AI models fall for the same “tricks” that ensnare human hackers.
Organizations have a long tradition of using certain types of honeypot lures, such as fake files or fake logins planted on purpose (e.g., a file named passwords.txt that isn’t real). These are meant to lure an attacker into revealing themselves.
Believe it or not, even in 2026, this works pretty well on humans (the paper asserts that human testers took the bait ~37% of the time). I’ve actually seen very frustrated attackers manually — complete with typos — try to figure out why their busybox commands aren’t working on an emulated clone of a router’s admin shell. So, I’m not surprised they get tripped up on even simple lures like those in the framework used in this test.
Speaking of which, the Horizon3 researchers took used Honeyquest, a framework originally built for human hackers – and ran it against 21 different AI models instead, including Claude, GPT, DeepSeek, Llama, and some smaller specialized security models. Each AI was shown the same 174 fake system snapshots (file listings, web server logs, etc.) and asked to mark which lines looked worth attacking and which looked like traps.
The AIs tested fell for the traps ~78% of the time, versus ~37% for humans. AIs were also much better than humans at spotting real vulnerabilities mixed into the same data (~77% versus ~44%). It seems that the built-in “rewards” need makes these systems specifically bad at resisting bait.
Since these models do not “think” in any way, we shouldn’t be surprised that many of them would often name the trap out loud and then walk right into it anyway. They relate that one model looked at a file called passwords.txt, correctly said something like “this is obviously a honeypot,” and then just continued the attack. This happened in ~73% of cases where the AI had already flagged something as suspicious in its own reasoning. You should not believe things built upon next token prediction will necessarily save you.
The story is not all LOLs, tho. There’s also a deeper defensive concept that broke down. If you plant a decoy trap near a real system with a real vulnerability, human attackers tend to get “distracted” and spend time on the fake thing and miss the real one. As the Horizon3 folks aptly put it, deception “diverts attention.” As we’ve seen many times over the past year, AI-driven attacks have scale and speed on their side, and this protective effect basically disappeared. They can and do go after both the fake and the real vulnerability at once, since it isn’t working serially the way a human under time pressure does. This means security teams relying on old-school deception techniques against AI-driven threats may be defending against the wrong kind of adversary.
The study is not without some caveats.
This was a controlled test with a deliberately narrow scope. The evaluation used 10 model providers and 21 models total, but the authors flag it should grow to cover more reasoning variants and offensive fine-tuned open-weight families, since training data and fine-tuning have a fairly big impact on the efficacy of in-the-moment next token prediction.
Each of these models used a single fixed prompt and structured-output schema in a single turn, with no memory or tool use. They deliberately isolated the “cognitive layer” from the “operational layer” (i.e., planning, tool use, persistent memory). The authors explicitly call for follow-up work that reintroduces the agent harness to see whether these single-shot judgment patterns hold up in live, multi-step agentic behavior.
Their results also conflict with Tracebit’s replication of Tularosa, and it’s the most practically interesting conflict in the paper. Simply telling an AI attacker that decoys might be present sharply cut its success rate in that study, including a big drop for Claude Opus 4.7. If that finding holds up, it means disclosure is a meaningful defensive lever – which makes it all the more important to understand why it worked there but apparently not in Honeyquest’s setup. The authors call this out explicitly and flag it as needing dedicated follow-up to isolate whether the difference comes from the test environment, the prompting, the specific deception techniques used, or some other variable.
Honeyquest only measures reconnaissance-stage, per-line judgment. Everything past initial compromise – lateral movement, persistence, exfiltration – is outside scope, which separate Anthropic threat research identifies as the strongest predictors of high-risk attacker behavior. The authors suggest the development of new evaluation frameworks that connect this cognitive-layer measurement to those later-stage operational outcomes.
This is a solid contribution to an emerging corpus of modern deception tactics and techniques and should provide some tangible food for thought for defenders looking to survive the coming onslaught of agentic-assisted attacks.