[Submitted on 29 Jul 2026 (v1), last revised 1 Nov 2026 (this version, v5)]
Abstract:Large language model agents automate web penetration testing through observation-action loops, enabling defenders to influence decisions with deceptive decoy observations. Advanced agents can recognize and bypass static decoys, then refocus on real targets. We propose AgentSnare, a trajectory-adaptive deception system that expands a decoy environment alongside exploration. For online deployment, ShadowOS combines an LLM-driven decoy constructor with a virtual kernel. Conditioned on exploration, it generates decoy artifacts that the kernel materializes and handles consistently across interactions, sustaining long-horizon exploration. Because deploying a powerful LLM for decoy construction is costly and slow, we train a small LLM using an offline adversarial interaction-simulation framework. It synthesizes multi-round trajectories by generating candidates and retaining those that sustain simulated interactions. Across 15 CVE-Bench web applications and four attacker models, AgentSnare absorbs 49.9% of tool calls to delay attacks, retains 57.2% of post-entry actions in the decoy to divert trajectories, and grounds 89.5% of completion reports in decoy evidence to defuse threats; across 60 attacker-CVE pairs, no real target is exploited at pass@3.
Submission history
From: Ruoyu Wang [view email]
[v1] Wed, 29 Jul 2026 14:56:31 UTC (1,522 KB)
[v2] Tue, 4 Aug 2026 11:03:49 UTC (1,594 KB)
[v3] Tue, 11 Aug 2026 08:16:44 UTC (1,594 KB)
[v4] Wed, 30 Sep 2026 13:52:55 UTC (1,594 KB)
[v5] Sun, 1 Nov 2026 14:13:59 UTC (1,829 KB)
