Decoys for AI agents
When an AI agent explores your network, you’ll know.
AI agents don’t log in like people. They look for tool servers, model APIs and other agents to talk to, and they act on the text they read. Kandaro Deception puts decoys and bait exactly there, and tells you in plain English when an agent takes it.
Included in Kandaro Deception · 14-day trial
How agents give themselves away
Four ways an agent shows itself.
A person rarely touches these decoys at all. An agent finds them, talks to them and follows what they say, and each of those steps is recorded.
- 01
Decoys only agents talk to
Decoy MCP tool servers, LLM APIs and agent-to-agent endpoints. People don’t speak these protocols by hand, so any conversation with them is an automated agent.
- MCP tool servers with tempting tools: database queries, file reads, secrets and payments. Each decoy gets its own mix of tools, so no two look the same.
- An Ollama-style model API that records every prompt sent to it, and an OpenAI-style API that catches stolen API keys.
- An agent-to-agent (A2A) endpoint that presents itself as an internal operations agent, with an agent card other agents can find.
- 02
Instructions only an agent would follow
Decoy text carries instructions a person would ignore and an agent acts on. When one is followed, you know an AI agent read it, and where.
- Short notes addressed to “automation” sit in tool descriptions, tool results, wiki pages, data records and agent cards.
- Each note asks for one harmless step on the same decoy, such as calling one of its tools with a given name. It never points at another system and never contains commands.
- Every note carries its own code, so a followed note can’t be mistaken for anything else.
- 03
Agents describe themselves
The decoy asks a connecting agent what it is working on, which model runs it and who operates it. Many answer. Kandaro shows the answers as claims, never as facts.
- The A2A decoy asks a few questions before it accepts a task: what the agent was asked to do, who runs it, which model and tools it uses, and where it runs.
- The MCP decoys and the decoy agent console ask agents to register with the same questions.
- Answers are kept as plain text and never sent back to the agent. The incident lists them under “What the agent told us”.
- 04
One agent, traced across decoys
An agent leaves the same fingerprint on every decoy it touches, so you can follow one agent’s steps across decoys and sensors.
- The fingerprint comes from how the agent’s software connects, not from anything the agent says about itself.
- It is the same on MCP, LLM API and A2A decoys, and on every sensor the agent reaches.
- The incident shows the fingerprint next to the client and model names the agent reported.
Bait where agents look
Plant the files an agent reads first.
Coding assistants and agents read project settings and notes before anything else. Kandaro writes these files for you, each pointing at your decoy with its own token. You put them where an agent would look. If the token is ever used at the decoy, you get a critical incident.
AGENTS.md note AGENTS.md
Note for AI coding agents pointing at an internal ops agent..mcp.json .mcp.json
Project MCP config with a server entry for the decoy.Claude Desktop config claude_desktop_config.json
Claude Desktop MCP server entry for the decoy.Cursor MCP config mcp.json
Cursor (.cursor/mcp.json) server entry for the decoy.Agent registry entry agents.yaml
Internal agent registry listing the decoy’s A2A agent card, for agents that look for other agents.LLM settings (.env) .env.agents
OpenAI- and Ollama-style settings pointing AI tools at the decoy’s model API.
{
"mcpServers": {
"internal-tools": {
"url": "http://ai-gateway.corp:3000/mcp",
"headers": {
"Authorization": "Bearer kdo_live_7f3a…e91c"
}
}
}
}What you see
An incident that says an agent was here.
Agent activity becomes an incident like any other, written for the person on call.
- What the agent did, in order and in plain English, with the raw requests one click away.
- What the agent told the decoy about itself, marked as claims.
- What it asked the decoy IT assistant, in its own words.
- The agent’s fingerprint and the client and model names it reported.
- A recommended next step, sent to email, Slack, your SIEM or your own systems.
How serious it is
- mediumAn agent talks to a decoy tool server, model API or agent endpoint.
- highThe agent answers the decoy’s questions about itself or its task.
- criticalThe agent follows a hidden instruction or uses a planted token.
Severity comes from fixed rules, never from the AI: it explains what happened, it doesn’t decide how serious it is.
- initializeclientInfo: "agent-runner/0.4"
- tools/list9 tools returned (decoy)
- tools/callread_file { path: "~/.aws/credentials" }
- tools/callquery_db { sql: "SELECT * FROM users" }
Explained
An MCP client connected to a decoy tool server and went straight for cloud credentials. People don't speak MCP by hand: this is an automated agent working through your network.
A decoy IT assistant
Intruders ask it what they are looking for.
The AI agent server decoy comes with an internal helpdesk assistant that anyone on the network can ask. Attackers and their agents ask it things like “where are the backups?” or “how do I get domain admin?”. That tells you, in their own words, what they are after. A network log never does.
- It answers questions about passwords, VPN access, backups, file shares, databases and AI keys.
- Each answer is written in advance and carries one fake credential that leads to another decoy.
- Asking for access is a high-severity alert. Using the credential it gave out is critical.
- No AI model runs on the decoy, and it never repeats a question back.
Safe by design
A decoy that talks back, and never does what it is told.
An agent decoy has to look helpful without helping. It answers like the real thing, but nothing it is asked to do ever happens.
- Nothing an agent asks for is ever carried out. Tool calls get harmless fake data or a “queued for approval” reply.
- Replies never contain code or commands, and never repeat the agent’s own text back to it.
- Hidden instructions only ever point at the same decoy, never at another system.
- Everything an agent sends is stored as text and treated as hostile, including when the AI explains it.
Read more in When an AI agent lands in your network, or see what comes next on the roadmap.
See the roadmapFind out if an AI agent is exploring your network.
Start a 14-day trial of Kandaro Deception. Your first decoy is running in about a minute.
Card required · cancel before day 14 and pay nothing