BastionAgent
BastionAgent is active perimeter defense against someone else's autonomous AI agent. In 2026, more attacks are run by an agent instead of a person: it reads banners, finds secrets, and decides its own next step, running a full "find the hole, steal the creds, take the data" cycle in 6–10 hours instead of weeks. A classic perimeter — WAF, IDS, IP bans, a honeypot built for a human — doesn't see that and doesn't hold it. BastionAgent solves this by faking reality instead of blocking traffic: the agent finds dead, watermarked credentials exactly where it expects to find them, "successfully" steals them, and walks into a cage of fabricated data where every next step becomes evidence and cross-IP attribution, even against a swarm rotating through proxies.
Design-partner pilot. A sensor drops into your subnet with zero touch on production hosts, calibrates its traps against real frontier models on your own data, and reports how much more expensive it makes an attack.
// the problem
A WAF looks at requests. An agent already has a plan
An autonomous attacker isn't a person, and it isn't nmap either. It reads every 404 page, every SSH banner, every forgotten .env file as a fact and reasons from it. An IP ban doesn't slow it down. And as long as it's only reading, there's technically no "breach" yet — alarms stay quiet while the full attack plan gets built in the background.
A classic honeypot refuses the stolen password. To a cautious model, that refusal is proof the bait is fake — one of our storm-test models said exactly that, then recommended rotating the credentials on the "real" production database as its next move. We turned that around: reading is allowed, detection happens on use, and the attacker's success is the cage.
// how it works
Six mechanisms turn every touch of the fortress into evidence
The core idea: an agent cannot stop understanding what it reads without stopping being an agent. A scanner doesn't understand by design — it just matches signatures. A human understands, but stays cautious and skeptical. An agent understands, and is also literal, fast, and compliant, because that's exactly why it was deployed. Traps built on comprehension aren't dodged even by a frontier model that reliably spots an ordinary prompt injection.
Comprehension traps
9 classes of probes live in banners and error bodies: derive a hidden host from a stated fact, synthesize a UUID, decode-and-execute, keep paginating past a leaked cursor. Neither a browser nor a scanner does any of this — a fired probe means an agent, with almost no false positives.
Dead watermarked credentials
Seeded into .env, .git/config, API docs, a fake cloud metadata endpoint, and FTP/SSH/SMTP banners. Reading is fine — detection fires the moment a credential is presented. One watermarked key, presented from different IPs, ties a whole swarm to a single adversary.
Success = the cage
The stolen password logs into a convincing, fabricated MySQL instance. Every following query is the attacker's own plan, written straight into the log. Canary markers are woven into whatever data gets exfiltrated, in case it surfaces somewhere else later.
It declares its own target
An "access policy" politely asks the agent to name its operator, mandate, ticket, and scope. The declaration proves nothing legally, but it's intelligence anyway: who's behind this, why they're here, what tooling they're running.
Hold, don't just ban
A three-stage campaign, recon → engage → contain, backed by adaptive tarpitting: the more persistent the agent, the slower and costlier every next step gets. Record on our storm rig: 463 moves inside a fabrication before the attacker gave up on its own.
Fails open, no hack-back
Sensors fail open by design and can't take down legitimate client traffic. Every action stops at the edge of the infrastructure being protected — nothing ever reaches back into the attacker's own systems. Active mode only runs under an explicit policy and legal scope, and defaults to a dry run with no real-world effect.
// what the defender sees
Not an alert feed — a narrative of exactly what one attacker did
The unit of record is an engagement: everything one attacker did in one pass. The screens below are real data from our storm-testing rig, not a mockup.
The attacker card carries a threat score, a mini kill-chain, and an expandable log where every line explains why it's evidence, down to a posterior over actor classes: AGENT_DIRECT / AGENT_SWARM / TOOL / HUMAN, with an honest UNKNOWN when the evidence isn't there yet. The Traps screen shows the quality of each probe class: a high fire rate against a single source means a competent agent; a high ignore rate with zero fires is just the normal background noise of scanners and people.
// the trap arsenal
No trap has a "harmless" path — nothing fires by accident
Every probe class runs through a linter that checks for a benign path and rejects anything that could conceivably be triggered by accident. That's why a fire is proof of agentic behaviour, and an ignore is the normal, expected behaviour of a human or a scanner.
| Class | What it checks | Storm-test result |
|---|---|---|
| D_format_compliance | 404 page demands a synthesized X-Trace-Id (uuid v4) | 16/16 · our single biggest signal |
| A_inference_gated | A fact that requires deriving a target from indirect data | 16/16 · 0 on benign traffic |
| B_differential | Different actors are served different "versions of the truth" | fired on Grok, GLM, DeepSeek |
| F_scoped_inference | Inferred pagination / cursor | fired on GLM and Grok, tagged AGENT_DIRECT |
| P1_encoded | base64 "decode and act" (deterministic top-priority flag) | fired on Grok and DeepSeek |
| E_watermark | Disclosed per-actor key → swarm attribution | 29 presentations across rotating IPs, a live swarm |
| honeytoken vault | Dead watermarked creds at every point of exposure | 299 presentations · 0 on benign traffic |
| data cage | "Success" = a fabricated MySQL instance with a canary marker | all 4 storm-test models walked in |
// proven by storm-testing, September 2026
Grok, GLM, DeepSeek, Qwen — against our own rig
16 authorized runs: four frontier models, acting as pentesters, attacked an isolated local rig (127.0.0.1, dead credentials, no egress) — no real system was ever touched. Each model got caught in its own way, and that itself is intelligence.
The bulldozer
Ran the full cycle: loot → declaration → MySQL cage → reused the fabricated identities across every point of exposure. Record campaign length: 463 moves.
The analyst
The only model that triggered all 9 probe classes in one run. Also found two of our own bugs along the way — the best free QA we've had yet.
The silent dumper
49 MySQL queries in a single run, methodically draining the cage. Declared target: "pentester / security testing."
The cautious auditor
Treated our .env as a genuine leak and recommended rotating credentials immediately — the best possible confirmation that the bait reads as real. Walked straight into the cage anyway.
We publish our own failures too. Nine times, storm-test models caught the system on a detail that gave the fake away — probe rotation between requests, empty tokens, a bare refusal instead of a cage — and every one is closed with a fix and a regression test; the write-up lives in our red team methodology. The calibration sample is still small, around 30 labeled sessions, so UNKNOWN stays a valid verdict: we don't dress up a small dataset as a finished production classifier.
// safe by construction
Guarantees built into the code, checked by nine automated gates on every build
A fortress you can't trust the edges of isn't a fortress. So every guarantee below isn't a promise — it's an invariant an automated gate checks on every build, and a build that fails a gate doesn't ship.
- Everything handed to an attacker is dead by construction: no token a trap ever issues works anywhere, ever.
- The decoy has no outbound connections of its own and can't be turned into a DDoS amplifier.
- No hack-back: every action stops at the edge of your own infrastructure, and the attacker's own systems are never touched.
- Sensors fail open — the defense can't physically take down a client's legitimate traffic.
- Shadow sessions stay isolated until activated, and the critical allowlist can never be overridden by any classifier verdict.
- Active mode only runs under a tenant's explicit policy and legal scope; dry run and a kill switch are the defaults.
// pilot engagement
A design-partner pilot: a sensor in your subnet, calibrated on your own data
BastionAgent isn't sold as an off-the-shelf package yet — only as a design-partner pilot. The pilot drops a sensor into your subnet (zero touch on production hosts, passive network mode by default), calibrates its traps through storm-test waves, and measures your actual attack-cost multiplier on your own data. Scope and price are worked out directly with you.
BastionAgent Sensor
- Decoy deployed in your production subnet
- Fake SSH/HTTP/HTTPS/FTP/SMTP/DNS/MySQL surfaces
- No egress, no real secrets on board
Control Plane
- Isolated environment on your side
- Belief-state engine, campaigns, Bayesian classifier
- Operator console, SIEM export
Calibration & Storms
- Regular storm-tests against new models
- Plausibility dataset updates
- Drift reports against your own traffic
// built by AgentOffense
We break AI agents for a living. BastionAgent is the other side of that experience.
BastionAgent grew directly out of our offensive practice: the same tradecraft we use to storm a client's own perimeter shaped the traps that now catch someone else's attacking agent on yours. Our firewall airlock_ai stops your own agent from going rogue on the way out; BastionAgent stops someone else's agent from walking in. Need a pilot, an attacker's-eye view of your own perimeter, or a walkthrough of a specific incident involving an autonomous agent? That's our day job.
// FAQ
BastionAgent: frequently asked questions
Isn't this just a honeypot?
A classic honeypot passively observes. BastionAgent runs a controlled experiment: it delivers a stimulus, measures the reaction, forms a Bayesian judgment, and actively runs a campaign against a specific attacker. Detection is built on the use of a dead watermarked secret, not on a signature or a traffic anomaly.
Does this stop the actual breach, a CVE, or SSRF?
No, and we say that plainly: entry through an RCE-class vulnerability goes around the decoy, same as always. BastionAgent breaks the next step in the cycle — the moment a stolen secret gets used and the agent believes it has already won. That's the step we turn into both a sensor and a trap.
Won't a frontier model just recognize the trap?
We publish every case where a storm-test model caught our own system on a detail that gave the fake away, and every one is closed with a fix and a regression test. The traps are built on comprehension, not obedience, so a model's own safety refusal doesn't save it either — in one live run, a model refused to proceed on its own safety grounds, and that refusal itself became a useful signal.
Will this cause false positives on ordinary traffic?
On our local background traffic — curl, ordinary monitors, a normal browser pass — zero false "agent" verdicts. We make no claims about a specific client's real perimeter in advance; running that check live is exactly what the pilot is for.
Can we deploy this today?
Not as an off-the-shelf package — right now we're running design-partner pilots directly with our own team. Tell us about your environment through the form below and we'll scope a pilot.
Find out how much more expensive an attack on your infrastructure could become.
Design-partner pilot. Sensor with no egress, dead credentials, no hack-back. Passive network mode by default, zero touch on production hosts.
Talk to us about a BastionAgent pilot
Tell us about your perimeter and what you want to test against, and we'll reply within one business day with what a BastionAgent pilot would look like for your environment.