Stinging the Swarm: Extracting Attacker Intelligence from a Twin-Controller OT Honeypot

Summary

Researchers present Talos, an inline gate that judges agent requests to industrial controllers in milliseconds and redirects flagged agents to a mirror-twin decoy of the real plant. Evaluated against 2,400 autonomous attacker agents across four tiers of escalating concealment, no write reached the real plant in any tier. The pipeline also extracts attacker intelligence, with identity clues such as self-reported toolchain fingerprints and targeted register lists accumulating into a high-confidence profile.

Related items

• HighCVE-2026-63651: LiveDocs is a primary-source-first documentation for AI agents. Prior to version 0.7.0, fetch_docs and introspect…Similar attack · NVD/CVE Database
• HighCVE-2026-125271 - AWS API MCP Server Security Policy Bypass via Incorrect Operation Name NormalizationSimilar attack · AWS Security Bulletins
• InfoLocation Matters: Sparse Latent-Variance Attacks for Face Privacy against Diffusion PersonalizationSimilar attack · Arxiv (cs.RO + cs.CV security)
• MediumCVE-2026-83953 GitHub Copilot for Jetbrains Information Disclosure VulnerabilitySimilar attack · MSRC Security Update Guide
• HighGHSA-ghwv-vrp2-2975: Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU AttacksSimilar attack · GitHub Advisory Database