Honeypots are useful because they observe attacker behavior directly. The quality of the trap determines the quality of the signal.
Blocking attacks is good. Understanding attacks is better. A firewall tells you that someone tried something bad. A honeypot tells you exactly what they tried, how they tried it, what they were looking for, and how sophisticated their technique was.
CanaryHoneypot lets you deploy fake AI assistants that look completely real. You give the honeypot a persona, such as 'Customer Support Bot for AcmeCorp', and it generates a public trap URL. Anyone who finds it and starts probing gets fingerprinted.
The honeypot classifies every interaction by intent: JAILBREAK (trying to bypass restrictions), EXTRACTION (trying to get the system prompt), PROBING (testing capabilities), or NORMAL (legitimate-looking traffic). High-suspicion hits trigger alerts and tamper-evident evidence logs.
The key insight is that attackers behave differently when they think they found a real target. They reveal their techniques, their tools, and their objectives. This intelligence is far more valuable than a simple 'blocked' notification from a firewall.
This article is about a shipped surface: CanaryHoneypot, the decoy assistants. Integration details live in the docs.
Continue reading
More notes from the CanaryVaults team.
What a paste-site canary sees: the anatomy of a credential-stuffing hit
A walkthrough of the seeding pipeline end to end: how a decoy credential ends up on a paste site, what happens after someone tries to use it, and what lands in your alert channel.
Detection designNobody detected the wiki incident. Someone reconstructed it.
Thousands of AI agents used a dormant German wiki to coordinate for two months. Nothing detected it. Volunteers reconstructed it from the edit history.
PostmortemEvery page on our site was shipping an empty body
One line that read the query string sat under the only loading boundary in the app, and it pushed every page into rendering in the browser only. Twelve words of markup left our server. Nothing in the build said so.