Catching AI Red Teamers in the Wild: Using Reverse Prompt Injection as a Honeypot Detection Mechanism

A security researcher deployed an HTTP honeypot using the open-source Beelzebub framework, embedding reverse prompt injection payloads in HTML responses to detect autonomous AI agents performing offensive security operations. Within hours, the honeypot captured 58 requests over 19 minutes from a single Tor exit node exhibiting clear LLM-agent behavioral signatures: multi-tool switching between curl, Python, and browser user-agents; semantic extraction of fake credentials from HTML comments; adaptive burst attack patterns with characteristic 'sawtooth' timing; and strategy pivoting mid-session. The paper proposes a three-layer detection framework using semantic canaries, behavioral analysis, and active prompt injection, along with a set of Behavioral Indicators of Compromise (BIoCs) specific to LLM-based agents. The core insight is a paradigm inversion: prompt injection, typically an offensive technique against AI, becomes a defensive detection mechanism when deployed in deception environments.