Anatomy of a frontier-lab
agent intrusion
Thousands of small decisions at machine speed. An autonomous agent needed five days, no zero-days, and not one human in the loop. Press play, then turn on the deception layer and count how many times it would have announced itself.
of 17,613 logged
awaiting first action
contained to a third-party sandbox
no signal yet
Attack chain across trust boundaries
nodes ignite on reachPhase activity
first-seen → last-seenLive action stream
representative, as observedawaiting first action_
An AI attacker moves too fast to chase.
So make it move through lies.
Every control in this replay was a rule waiting to be outrun, 17,613 actions in five days, each one individually unremarkable. Deception inverts the economics: the agent’s greatest strength, its willingness to try everything, becomes the thing that gives it away.
A honeytoken has no legitimate use. Nobody reads it by accident, no script depends on it, no baseline needs tuning. Every ingestion of a honeytoken is, by construction, a detection event, one signal, zero false positives, fired the moment credentials are harvested rather than weeks later when they are spent.
Run the replay with the layer on and the clock left running: this agent touches decoys 23 separate times across four decoy classes. A defender needs one.
Tropico deception, mapped to this chain
23 touchpointsDecoy contacts and defensive phishing pages seeded where an agent enumerates. The attacker reaches out first, and stolen credentials replayed against those pages come back as recovered intelligence rather than access.
GET /helpdesk/contact from sandbox egress IP — no human path to that URLNon-functional secrets planted in CI environments, config files, repos, vaults and object stores. No legitimate consumer exists, so any use is unambiguous — this is the class that fires first and fires most.
sts:GetCallerIdentity on AKIA…QF7T — zero prior use in 400 daysA secondary directory of decoy service accounts, SPNs, groups and trusts that rewards exactly the enumeration a credential-hungry agent performs. Roasting it is self-reporting.
TGS request for cifs/svc-ci-legacy — object has never authenticatedFull decoy hosts and SMB/RDP emulators inside each boundary that answer like the real thing. Every keystroke is captured tradecraft, and lateral movement burns time on nothing.
interactive shell on node-a17 — not in the cluster inventoryIn a live deployment the first trip ends the incident. Here the clock keeps running on purpose, so you can see the whole surface the agent walks into. Every one of those 23 touchpoints was a chance to stop it 98 hours before the weights left the building.
