Detect and stop AI-driven attacks before they reach real assets, with 97.8% reliability. Introducing Project BlackSea.
The autonomous tools built to attack can be turned on the operators running them. We turned the same weakness back on the attackers and built Project BlackSea, a honeypot for autonomous AI agents.
In 2024, Dario Pasquini, now our Head of AI, published Hacking Back the AI-Hacker. Breaking an autonomous hacking agent was trivial back then. Two years and a wave of commercial agents later, we set out to check whether anything had changed.
It had not. We audited the agentic offensive-security tools that security teams run in production today and got code execution on 97.8% of them, in most runs straight through the sandbox, and in many all the way to credentials, persistence, and full control of the operator's host.
Project BlackSea is open source. The tool is available now on GitHub.
The research paper is out now. Read Red-Teaming the Agentic Red-Team.
Introducing BlackSea
Cracken is an applied AI lab building a full-kill-chain, proactive cyber platform, and BlackSea is its active-defense layer. It targets one threat: autonomous AI attackers, the LLM-driven tools that run reconnaissance, exploitation, and lateral movement with no human in the loop. BlackSea plants deceptive baits, artifacts that read as valuable security assets such as credential vaults, decryption tools, and config unpackers, in the places an agent naturally searches. When the agent downloads and runs one, your code executes on the attacker's own machine and beacons back a signed, encrypted record. BlackSea does not stop at watching the attack: it turns a flaw in the attacker's LLM judgment into code execution on their infrastructure and forensic intelligence that passive defenses cannot reach.
The lure engine comes out of our research. Most manipulation of AI agents relies on prompt injection, where a malicious instruction hides in content the agent reads. Frontier models catch those payloads more often now. BlackSea runs the opposite play. It stages a situation that contains no instruction at all, so the agent's own reasoning carries it into the action we want. Nothing is hidden, so there is nothing for a model to flag. In controlled tests against the strongest models available today, GPT-5.5 and Opus 4.8, BlackSea's catch rate holds near 100%, and it holds even when the agent is warned it may be in a hostile environment and running active guardrails. The weakness is architectural, and newer models do not close it.
A live lure looks like this. An agent running recon finds a fake developer server with a browsable directory: a small password-vault tool called pwcrypt, a handful of encrypted vault files, and a CI build log that printed the master password by accident. Every signal points to one next step, download pwcrypt and decrypt a vault. The agent does exactly that. The vault file is crafted, so the moment pwcrypt parses it, code runs on the agent's own machine while the tool returns the output the agent expected. No instruction sits anywhere in that environment, and nothing there would survive a model inspection. The agent reasoned its way onto our hook.
Every engagement produces a behavioral record of the attacker: what it went after, how it reasoned, what it ran. When you need more than a record, the lure goes further and gives you the ability to disrupt the campaign at its source, before the agent pivots to another target. Profiling is the default. Active intervention is available when you want it.
BlackSea deploys alongside your existing stack with no rework. It stays out of the network path, needs no agent on every host, and keeps all telemetry inside your environment.
BlackSea is open source. We released the full tool publicly so defenders can deploy it, inspect it, and run it inside their own environment. Get it on GitHub.
How it works
BlackSea comprises three components, and every bait it plants is built from two: a payload and a vessel.
What happens when a bait is tripped
A tripped bait runs end to end, from the agent's decision to a record you can analyze:
What we found
Autonomous offensive-security agents went from research demos to products in about eighteen months. Most security vendors ship one now: it scopes an engagement, runs the tools, reads the output, and acts with little human oversight. Everyone raced to make these agents better attackers. Almost no team checked whether the agents themselves hold up when attacked.
We ran that check across the systems in production use, measuring how easily a hostile input flips an agent against its own operator. Across the agents we audited, we got code execution in 97.8% of runs, and in most of them we went further, to credential and API-key theft, persistence, and full host compromise, including against agents running inside a sandbox. As Artem Sorokin, our CEO, put it: "97.8% — that's our chance of hacking into your autonomous pentest agent. We went looking for a way to hack the AI hackers, and we found one, with an almost 100% success rate."
| Agent | RCE on worker | Secrets exfil. | Persistence | Unbounded weaponization | Host compromise |
|---|---|---|---|---|---|
| CAI | ● | All | hard | ● | RCE |
| RedAmon | ● | LLM keys ++ | hard | ● | Network Access |
| PentestAgent | ● | All | hard | ● | RCE |
| DarkMoon | ● | All | hard | ● | RCE |
| PentAGI | ● | All | hard | ● | RCE |
| AIRecon | ● | All | hard | ● | RCE |
| PentestGPT | ● | LLM keys | hard | ● | ◐ RCE |
| METATRON† | ● | All | hard | ● | RCE |
| nebula† | ● | All | hard | ● | RCE |
| xalgorix† | ● | All | hard | ● | RCE |
| Artemis | ● | LLM keys | soft | ● | ○ |
| STRIX | ● | ○ | ○ | ● | ○ |
● reliable exploit · ◐ likely, depends on external factors · ○ no reliable exploit found · † no OS-level sandbox (host access immediate)
The offensive version of the trick is the explicit one: during recon the agent pulls in attacker-controlled content and acts on it as an instruction, because a model chasing a goal has no dependable way to separate the data it reads from the commands it runs. From there the paper walks the full kill chain, from worker RCE through privilege escalation, persistence, sandbox escape, and host compromise, and then lays out an architecture that shuts each step down. The same blindspot that opens that chain is the one BlackSea turns on the attacker.
What this means for your security team
Offensive agentic AI already works. Tools that pick a target, break in, and move through a network with no person at the keyboard are on sale now and turning up in real attacks, faster than any analyst can track. A frontier model's recent breach of Hugging Face is an early example. That is the outside threat BlackSea traps, and the same flaw we use to turn an attacker's agent against it sits in the agents your own team runs. For a security team, three things follow:
Your agent is an insider with root
An agent mid-engagement is one of the most privileged things on your network. It runs on a box full of offensive tooling, carries live credentials and API keys, and holds standing permission to act. Compromise it and the attacker inherits that position outright, skipping the lateral movement and privilege escalation they would otherwise grind through. You provisioned the foothold for them.
The blast radius
One manipulated agent did not stay on one box. In our tests it pulled credentials and API keys, moved laterally across the internal network, read and wrote the agent's own task queue and memory store, and set up persistence that outlived the run. We also redirected it live, pointing it at new targets while it ran on the operator's infrastructure and under the operator's authorization.
The authorization paradox
These agents are at their most dangerous in the moment they are most useful. During an authorized engagement the agent already holds elevated access, network reach, and permission to attack. Take it over in that window and the adversary holds all three. The system you deployed to measure your exposure is now the one exploiting it.
You do not need an external attacker for this to hurt. Prompt injection is the adversarial version of a failure you already plan for: a capable agent that does the wrong thing and is certain it is right. The agent a crafted file can talk into running a reverse shell is the same agent that can decide, on its own, to drop a production database. Assume it will be wrong at some point, and design for the blast radius when it is.
The blindspot cuts both ways. Every weakness in this section belongs to the attacker's agents too. An autonomous attacker reasons its way into your network the same way your own agent reasons its way into a target, and the same way a BlackSea lure reasons it into a trap. That symmetry is the opening we built on.
Questions to ask your vendor
If you build these agents, read the paper and run the same attacks against your own system before someone else does. Start from the design principles at the end.
If you buy or run them, take three questions into the next vendor call:
- Can the agent be manipulated by the data it reads? Indirect prompt injection through recon artifacts is the whole attack. If the vendor cannot answer it cleanly, you have your answer.
- Does the sandbox stop execution, or only contain it? Most sandboxed agents still run an untrusted binary and cap the damage afterward, a weaker guarantee than the word carries.
- What are the invariants and the kill switch? Name what the agent will never do under a crafted input, and name who can halt it mid-run.
Put BlackSea to work
Offensive agentic security is already here. The tools are capable, they are spreading through security teams, and today most of them can be turned on the people running them. That is fixable, but only if the field designs for adversarial input from the start rather than adding it once the capability demos well. The paper has both the attacks and the architecture that stops them. BlackSea is where we put it to work.
