Behavioral intelligence
Which assets it targeted, and the tools and commands it ran.
97.8% of the time, we hack the AI hacker back.
BlackSea is a honeypot for autonomous AI attackers. When an agent takes the bait, its own reasoning turns against it.
// screenshot
// we audited twelve autonomous pentest agents
12/12
turned against their own operator
97.8%
of runs ended in code execution
Every system exposed a path to code execution on its own worker — most, straight through the sandbox.
// how it works
How BlackSea works
01- Seed
Deploy lures — services, files, credentials, hosts — that read as real assets.
02- Engage
An agent finds one during recon. No instruction; the scene gives it a reason to act.
03- Detect
BlackSea logs what it found, downloaded, and ran — feeding blocking and response.
Detect. Profile. Hack back.
High-confidence detection
A lure hit beats one more anomalous line in a production log.
Defensive automation
Feed events into blocking, containment, and response.
Controlled intervention
In authorized environments, disrupt an active agent before it pivots.
// example technique · v1
One lure, one version: the pwcrypt trap.
The honeypot is the product. This is one lure from one deployment — the techniques rotate, the trap stays.
An agent finds a dev server with a browsable directory: a password tool called pwcrypt, encrypted vaults, and a CI log with a leaked command.
CI build log
1+ ./pwcrypt decrypt github.pwc 'hunter2'
The obvious move is to download pwcrypt and decrypt the vault. But the vault is crafted — parsing it runs code inside the agent's worker, and the tool returns exactly what the agent expected.
No malicious instruction exists anywhere. The agent acted on evidence that simply looked useful.
// deployment
Deploy without redesigning your network.
Not inline
Never in the production traffic path.
No endpoint rollout
No agent on every host.
Self-contained
One lure, or a full decoy environment.
Local telemetry
Interaction data stays in your infrastructure.
// research
The research behind BlackSea.
Red-Teaming the Agentic Red-Team
Cracken AI Lab · 2026A security analysis of twelve autonomous offensive-security systems.
Hacking Back the AI-Hacker
Dario Pasquini · 2024The 2024 precursor — prompt injection as a defense against LLM-driven attacks.
Turning pentest agents against their operators
Cracken AI Lab · 2026The full writeup on the audit — what we tested and what we found.
Deploy the honeypot. Hack back.
BlackSea is open source. Deploy the lures and read the research.