Detecting malicious AI agents: bait, fingerprinting and actor tracking
You can't watch for something you can't see. Here are the three signals that actually work for catching hostile AI agents — and how they combine into attribution a defender can act on.
Detecting a malicious AI agent is a different problem from detecting malware or a human attacker. There's no file to scan and no registry to check. An agent reads a page, decides what to do, and acts — often indistinguishably from a careful user. So how do you catch one? Three signals do the real work.
1. Bait — turn intent into a signal
The hardest part of detection is observability: you can't watch for something you can't see. So instead of monitoring all traffic and guessing, you plant bait only a malicious actor would take — on-chain decoys, web lures with fake credentials, and honeypots in the agent tool layer. Reading the bait is harmless; acting on it is a decision an honest agent never makes. That turns hidden intent into a clear, high-confidence event.
2. Fingerprinting — name the model behind it
Once an agent takes the bait, its behaviour carries a signature. From the sequence of actions alone, the model family behind an agent can be inferred with high accuracy — far above chance. That won't tell you the individual operator, but knowing whether you're facing one model family or several, and how that mix shifts over time, is exactly the intelligence defenders lack today.
3. Actor tracking — link the sightings
A single catch is an anecdote; a linked campaign is intelligence. The same agent usually strikes more than once, so the real value is connecting those hits into one actor. On-chain, a reused wallet is a strong, near-free link. Off-chain, a canary token embedded in each fake credential reveals exactly which lure it was stolen from when it's reused elsewhere. Together they turn a hundred scattered incidents into a handful of distinct actors — and tell you which ones are repeat offenders.
From detection to action
Detection only matters if it ends in something you can do. Every signal above resolves to a recommended action — block this wallet, revoke this token, flag this source — plus a machine-readable feed your firewall, WAF, contract allowlist or SIEM can act on automatically.
Bait turns intent into a signal. Fingerprinting names the model. Actor tracking connects the dots. Together they're an early-warning network.
See the network in action
Explore live detections on the public atlas, or talk to us about protecting your systems.