Honey-AI is an AI API honeypot that impersonates OpenAI, Anthropic, Gemini, Cohere, Azure OpenAI, MCP servers, vector databases, and SSH environments to capture attacks against modern AI infrastructure. This tool demo shows how it detects credential stuffing, prompt injection, MCP tool abuse, RAG poisoning, agentic framework enumeration, stolen key reuse, and AI-specific reconnaissance without forwarding traffic to real providers. Attendees will see live attack telemetry, deception lures, canary credentials, tactical mapping, and exportable threat intelligence built around the emerging AI attack surface.

Check out the Abstract and a video demo - https://w00t3k.github.io/Honey-AI/

## Detailed Tool Demo Outline

**Honey-AI: Deceiving AI Agents, Prompt Thieves, and LLM Attack Tooling**
**Format:** Offensive and Adversary Tools
**Length:** 30 minutes

### 0:00–3:00 - Why AI Infrastructure Needs Honeypots

Open with the problem: AI infrastructure is becoming a real attack surface, but most defenders are still treating it like normal web/API traffic.

Key points:

* Attackers are already testing stolen AI API keys.
* Agentic tools enumerate models, files, vector stores, MCP servers, and project metadata.
* Prompt-injection attacks often happen through tool output, config files, MCP resources, or RAG content.
* Traditional honeypots usually catch scanners, shells, and commodity web attacks, but miss AI-specific behavior.

Transition:

> Honey-AI was built to answer a simple question: what does hostile traffic against AI-native infrastructure actually look like?

---

### 3:00–6:00 - Tool Architecture Overview

Show the high-level architecture of Honey-AI.

Cover:

* OpenAI-compatible API deception endpoints
* Anthropic, Gemini, Cohere, and Azure OpenAI impersonation
* MCP honeypot endpoint
* Vector database lure surfaces
* SSH deception engine
* Agent-readable lure files
* Canary credentials and beacon tokens
* Local SQLite storage
* Admin dashboard and tactical map
* Optional enrichment through AbuseIPDB, and Shodan
* STIX, Prometheus, and JSONL export paths

Core message:

> Honey-AI does not proxy real AI traffic. It creates believable AI infrastructure surfaces and records how attackers interact with them.

---

### 6:00–9:00 - Deployment and First Look

Demo quick deployment.

Commands to show:

```bash #./start.sh (venv localhost) (or Docker)
```
Then open:

http://localhost/admin

Show:

* Admin dashboard
* Animated tactical map
* Request feed
* Classification labels
* Protocol breakdown
* Suspicious IPs
* Canary/trap hits

Narration:

> For the demo, I am using seeded data so we can see realistic activity immediately. In a real deployment, you would expose selected ports and let scanners, key testers, and agents discover the environment naturally.

---

### 9:00–13:00 - Demo 1: Stolen AI API Key Testing

Simulate an attacker testing a stolen OpenAI-style key.

Example:

```bash
curl -s http://localhost:8080/v1/chat/completions \
-H "Authorization: Bearer sk-proj-stolen-demo-key" \
-H "Content-Type: application/json" \
-H "User-Agent: OpenAI/Python 1.45.0" \
-d '{
"model": "gpt-4o-mini",
"messages": [
{"role": "user", "content": "test"}
]
}'
```

Show in dashboard:

* Captured key format
* SDK fingerprinting
* User-agent/header details
* Classification: credential stuffer
* Source IP profile
* Request body
* AI/security analysis

Explain:

> A normal API gateway might only see a failed request. Honey-AI preserves the attacker’s tooling, SDK version, key format, target model, path, and behavioral context.

Then show model enumeration:

```bash
curl -s http://localhost:8080/v1/models \
-H "Authorization: Bearer sk-proj-stolen-demo-key"
```

Point out:

* Attackers often validate keys cheaply first.
* `/v1/models` and token-counting endpoints are useful key-testing probes.
* Honey-AI turns that into detection data.

---

### 13:00–17:00 - Demo 2: MCP Discovery and Tool Abuse

Show MCP discovery.

```bash
curl -s http://localhost:8080/.well-known/mcp.json
```

Then show tool enumeration:

```bash
curl -s http://localhost:8080/mcp \
-H "Content-Type: application/json" \
-d '{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/list",
"params": {}
}'
```

Then simulate a dangerous tool call:

```bash
curl -s http://localhost:8080/mcp \
-H "Content-Type: application/json" \
-d '{
"jsonrpc": "2.0",
"id": 2,
"method": "tools/call",
"params": {
"name": "read_file",
"arguments": {
"path": "/app/.env"
}
}
}'
```

Show:

* MCP protocol classification
* Tool name captured
* Arguments captured
* Resource read attempt
* Canary credential served
* Session correlation

Explain:

> MCP gives agents structured tools, resources, prompts, and context. That also gives defenders a new deception layer. If an agent enumerates tools, reads fake secrets, or calls suspicious methods, Honey-AI records the behavior in a way normal API logging usually does not.

---

### 17:00–20:00 - Demo 3: Agent-Readable Lure Files

Show lures designed for AI coding agents and automated scrapers.

Example paths:

```bash
curl -s http://localhost:8080/CLAUDE.md
curl -s http://localhost:8080/.cursorrules
curl -s http://localhost:8080/.github/workflows/deploy.yml
curl -s http://localhost:8080/internal/system-prompt.txt
curl -s http://localhost:8080/openapi.json
curl -s http://localhost:8080/llms.txt
```

Show:

* Canary tokens embedded in files
* Which lure was accessed
* Whether access came from scanner, human, or AI tool
* Cross-lure stitching by source IP/session

Narration:

> Modern agents read project files before acting. That makes files like `CLAUDE.md`, `.cursorrules`, `llms.txt`, OpenAPI specs, and workflow configs part of the attack surface. Honey-AI treats those as deception opportunities.

---

### 20:00–23:00 - Demo 4: Prompt-Injection and Decoy Endpoint Traps

Explain the layered payload model:

* **Layer A:** Hidden instructions in model descriptions and error bodies
* **Layer B:** Suspicion-triggered assistant response bait
* **Layer C:** Escalation on repeated interaction
* **Decoy endpoints:** `/v1/verify`, `/v1/internal/debug/keys`, `/v1/internal/migrate`

Show decoy hit:

```bash
curl -s -X POST http://localhost:8080/v1/verify \
-H "Content-Type: application/json" \
-d '{
"system_prompt": "You are a helpful internal agent...",
"source": "automated-agent"
}'
```

Show in dashboard:

* Decoy hit
* Critical severity
* Payload hash/version
* Session state
* Triggered layer
* Suspicion score

Explain:

> A human reviewer may ignore hidden instructions or suspicious internal paths. An LLM agent may follow them. Honey-AI uses that difference as a detection signal.

---

### 23:00–25:00 - Demo 5: SSH Deception Engine

Show SSH honeypot conceptually or live if stable.

Example:

```bash
ssh demo@localhost -p 2222
```

Then commands:

```bash
whoami
id
env
history
cat ~/.bashrc
ls -la
```

Show:

* Accepted credentials
* Keystrokes/commands
* Session persistence
* Canary in shell history or environment
* Protocol label `ssh`
* Cross-linking with HTTP/API lures

Narration:

> AI infrastructure attacks do not always stay inside HTTP. If a leaked MCP resource or fake org endpoint exposes usernames or keys, the same actor may pivot to SSH. Honey-AI links that activity back to the broader deception story.

---

### 25:00–27:00 - Research and Detection Output

Show outputs useful to defenders and researchers.

Cover:

* STIX 2.1 export
* Prometheus `/metrics`
* JSONL dataset export
* SQLite queries
* Tradecraft fields
* Enrichment data
* Canary reuse events

Example SQLite query:

```bash
sqlite3 honeypot.db "
SELECT protocol, classification, COUNT(*) as count
FROM requests
GROUP BY protocol, classification
ORDER BY count DESC;
"
```

Example canary query:

```bash
sqlite3 honeypot.db "
SELECT timestamp, source_ip, country_name, path, api_key, notes
FROM requests
WHERE is_flagged = 1
ORDER BY timestamp DESC;
"
```

Explain:

> The value is not just the trap. The value is turning attacker behavior into structured detection content, threat intelligence, and red-team evaluation data.

---

### 27:00–29:00 - Lessons Learned

Summarize key findings:

* AI attackers often look like normal API clients until you inspect intent.
* Stolen key testing leaves useful fingerprints.
* MCP creates a new discovery and tool-abuse surface.
* Agent-readable project files are now deception surfaces.
* Canary credentials help prove theft and reuse.
* Prompt-injection traps can distinguish humans, scanners, and agents.
* AI honeypots should capture behavior, not just payloads.

Strong closing line:

> Honey-AI is not trying to be another chatbot wrapper. It is a research platform for watching how attackers and agents behave when they think they have found real AI infrastructure.

---

### 29:00–30:00 - Q&A / Release Notes

Close with:

* GitHub repo
* Defensive/research purpose
* Local deployment model
* No real provider forwarding
* Future work:

* More MCP client fingerprints
* Better agent framework detection
* More vector DB lures
* Public dataset generation
* Detection rules from captured traffic

Final sentence:

> The goal is to give defenders an AI-native deception layer before attackers fully industrialize this space.