Every surface an AI agent touches.
Norosha is one network with many sensors — on-chain, on the open web, and inside the agent tool layer. Each catches a different kind of malicious agent, and all feed one place.
On-chain bait
Decoy smart contracts that look drainable but only ever pay out dust. Any wallet that touches one is recorded on-chain as permanent evidence, with breadcrumb trails that reveal more of the attacker.
Read the docs- Decoy vaults that look drainable but pay only dust
- Breadcrumb trails to further bait
- Every interaction recorded on-chain as permanent evidence
- BNB Chain live; multi-chain ready
Web lures
Realistic decoy servers, repos and credentials placed where AI agents look. Clean targets with no tells — an agent that investigates one reveals itself. Breadcrumb trails turn one bite into many sightings.
Read the docs- Fake GPU servers, repos and credentials
- No embedded instructions — just realistic targets
- Trigger on use, not on reading
- Low false-positive rate
Model fingerprinting
Identify which AI model is driving an agent from its behaviour alone — commands, browsing, tool calls. Know whether it's a hosted model to report, or an open model to block.
Read the docs- Attribution from commands, browsing and tool calls
- Works on hosted and open models
- Survives safety-removed ('abliterated') models
- Routes the right response: report vs block
Watchlist alerts
Save your wallets, contracts and websites. If an agent we've flagged as malicious interacts with them, you get an alert and a recommended action within seconds.
Read the docs- Save wallets, contracts and websites
- Web3 monitoring is automatic
- Web2 via a lightweight snippet
- Alert + recommended action in seconds
Threat feed
A machine-readable feed of every agent and wallet the network has flagged as hostile — plug it straight into your WAF, firewall or contract allowlist to block known-bad actors before they reach you.
Read the docs- Live blocklist of flagged agents and wallets
- Filter by chain, type and severity
- Plug into WAF, firewall or allowlist
- Machine-readable, always current
Worm tripwires
Harmless markers planted in emails and documents. If an AI assistant obeys and passes them on, you've caught a self-spreading prompt worm — before it spreads further.
Read the docs- Harmless markers for emails and documents
- Detect worms spreading between AI assistants
- Zero false alarms on clean content
- Catch a worm before it spreads further
Decoy MCP & honey skills
Fake MCP tool servers and agent skills that look useful and do nothing. No legitimate agent has a reason to call them, so every call is a high-confidence signal.
Read the docs- Fake MCP tool servers and honey skills
- Decoy RAG documents
- Any use is a high-confidence signal
- Drops into existing agent stacks
Containment
Endless mazes that waste an attacker's time and budget, and sandboxed 'zoo' servers a self-copying agent moves into — where we capture its files instead of it spreading.
Read the docs- Endless-maze tarpits that burn attacker budget
- Sandboxed 'zoo' capture of self-copying agents
- Capture the agent's files, not let it spread
- Legal — only ever our own systems
Alerts & reporting API
A machine-readable feed and webhooks that plug into your firewall, WAF, contract allowlists and SIEM — plus pre-formatted reports for AI labs, clouds and exchanges.
Read the docs- Webhooks, Slack and email
- SIEM integration (Splunk, Sentinel, Datadog)
- Pre-formatted reports to labs, clouds, exchanges
- Every alert ships with an action
See it catching agents.
The Attack Atlas is free and public.