{"data":{"id":"ff41fdff-7716-4b65-a5a9-b6c250e08c39","title":"Stinging the Swarm: Extracting Attacker Intelligence from a Twin-Controller OT Honeypot","summary":"Researchers present Talos, an inline gate that judges agent requests to industrial controllers in milliseconds and redirects flagged agents to a mirror-twin decoy of the real plant. Evaluated against 2,400 autonomous attacker agents across four tiers of escalating concealment, no write reached the real plant in any tier. The pipeline also extracts attacker intelligence, with identity clues such as self-reported toolchain fingerprints and targeted register lists accumulating into a high-confidence profile.","solution":"N/A -- no mitigation discussed in source.","labels":["security","research"],"sourceUrl":"https://arxiv.org/abs/2611.13406v1","publishedAt":"2026-11-10T00:38:48.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"info","attackType":["other"],"issueType":"research","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["autonomous language-model agents"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-11-10T00:38:48.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["integrity","availability","safety"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.92,"researchCategory":"preprint","atlasIds":null}}