What an AI agent does when it lands in your network

A human intruder is careful. They look at a few files, try a few things and avoid anything that smells like a trap. An autonomous AI agent behaves differently, and that difference is something a defender can use.

Agents read everything

An agent working through a machine reads every file it can reach, because reading is cheap for it. Config files, scripts, shared drives and, increasingly, the files written for agents themselves: .mcp.json, which lists the tool servers an agent may use, and AGENTS.md, which tells it how a project works.

That makes those files a very good place for a breadcrumb: a pointer to a server that does not really exist, with a token that nobody legitimate will ever use.

Agents talk to anything that looks helpful

Where a person would hesitate, an agent that finds a tool server connects to it and asks what it can do. Kandaro runs decoys that speak the protocols agents use: MCP tool servers, OpenAI-compatible and Ollama-style model APIs, and agent-to-agent endpoints.

People do not speak these protocols by hand. So a call to a decoy tool server is a strong sign that an automated agent is loose in your network, and the calls it makes show what it is after. An agent that lists the tools and immediately asks to read cloud credentials has told you its goal.

What you get out of it

The same thing as with any other decoy: an incident in plain English. Which machine the agent ran on, what it asked for, and what to do next. If it used a planted credential anywhere it reaches a decoy, that is raised as critical, because there is no innocent explanation for it.

Why this matters now

Detection tools that watch for unusual human behaviour have little to go on when the intruder is a program that works at machine speed and does not get tired. A decoy does not need to recognise the behaviour. It only needs to be touched.

Read more about AI-agent decoys in Kandaro Deception, or start with why decoys produce so few false alarms.