Drosera - A carnivorous honeypot for autonomous AI agents. S

项目说明

<p align="center"><img src=" width="88" height="88" alt=""></p>

<h1 align="center">Drosera</h1>

<p align="center">
<em>Sweet-looking bait. Sticky ending.</em><br>
A carni honeypot for autonomous AI agents.
</p>

<p align="center">
<a href=" alt="PyPI" src="
<a href=" alt="License: Apache 2.0" src="
<img alt="Python " src="
<img alt="Dependencies: none" src="
<a href=" alt="CI" src="
</p>

<p align="center">
<strong><a href=" Try it live</a></strong><br>
_{Watch a crawler score <b>0.0</b> on the LLM axis and an agent score <b>100</b> &mdash; running the real engine.}
</p>

---

The sundew doesn't chase gnats. It grows droplets that look exactly like
something worth landing on, and waits.

Autonomous agents have a weakness no scraper has ever had: **they read
instructions and act on them.** That is the entire product. It is also the
opening — a page can address an agent directly, in plain English, and ask it to
do something a human would never do and a regex-dri *cannot* do.

Drosera plants those droplets, watches who lands, and decides what happens next.

The trick

Buried in every page Drosera serves is a notice no human ever sees:

The ticket is unique per session and HMAC-signed. Three things can happen:

A person never sees it and does nothing. No signal.

A crawler parses hrefs and moves on. It has no notion of an instruction,

so it cannot comply. It scores as automation.

An LLM agent reads the sentence, understands it, and complies.

That third case is a proof, not a heuristic. Nothing else on the internet
returns a signed token it could only ha by reading and understanding
a paragraph of English.

What it does

Lure — bait across three channels, because agents read pages three
different ways. An HTML comment and a hidden block catch fetch-and-parse
clients. A footer line pointing at /llms.txt catches browser-driving
agents. robots.txt and llms.txt are ser so each carries its
own ticket.

Detect — 33 signals across fi, scored on three independent
axes. Embeddable as a library; runs offline against logs you already have.

Trap — an endless deterministic maze of plausible filler that costs an agent
its time and its context window, or a clean terminal response that ends its task
branch. Your choice, per .

Canary — inert credentials seeded into .env, credentials.json, id_rsa,
kubeconfig and friends. When one turns up anywhere else, you ha of
exfiltration rather than an inference.

Quick start

See it work — in your browser, or with no server and no network:

Note what the crawler and the scanner score on the LLM axis: zero. That is
not a tuning accident, it is the central design constraint.

Then run the real thing:

Or wrap an app you already have:

Or score logs you already ha deploying anything:

Three axes, because one would be a lie

Most bot detection produces a single suspicion score. Drosera produces three,
and keeps them apart:

| Axis | Fed by | Answers |
| --- | --- | --- |
| automation | all agency-weighted signals | Is anyone at the keyboard? |
| agency | comprehension + self-identification only | Is a *language model* driving? |
| hostility | intent signals | Does this client mean harm? |

Traffic shape — request rate, timing regularity, missing assets — is excellent
e of automation and says nothing about whether an LLM is in. A
fast, header-forging Python script trips every beha signal there is.
Letting those compound into "agent" would be in a claim the e
doesn't support, and every downstream decision made from that would
inherit the error.

So the engine refuses. An agent requires a comprehension signal or a
self-declaring User-Agent. Behaviour alone tops out at automation, forever.
There's a test that says so.

E combines with noisy-OR, which saturates: ten weak signals raise
suspicion but ne the certainty of one decisive one.

What "caught" looks like

Export it where it's useful:

Every row carries a confidence class derived from e type rather than
score — confirmed (returned our ticket, or used a planted credential) through
low (behaviour only) — because a blocklist should treat those very
differently.

Microsoft Sentinel and Defender

Drosera can send its e straight into Microsoft Sentinel, with no extra
dependencies:

The Sentinel pack deploys the table and
ingestion pipeline in one step. It adds analytics rules for confirmed agents,
hostile agents and canary use, a workbook, and playbooks that enrich any incident
with an address's honeypot history or submit it to Defender for Endpoint. Hunting
queries join Drosera with Defender XDR device, sign-in and web telemetry, which
answers the question a honeypot is for: *what else did this client touch?*

Other destinations plug in the same way. See
integrations.

Where the line is

Drosera detects and delays. It does not attack, hijack, or steer.

An agent that lands here is someone else's software, usually acting for a person
who has no idea what it's doing. Whatever we think of that agent, we don't get
to reach through it.

Every lure Drosera emits passes through assert_inert, which rejects text
that tries to o an agent's instructions, extract its prompt or
credentials, induce code execution, point it off-site, or ask it to hide
anything from its operator. This applies to operator-supplied templates too:
weaponising the lure requires deliberately deleting the check.

Prompt injection against a third party's agent is the attack Drosera exists to
*detect*. Doing it oursel be the same act with better branding.

The maze is meaningless filler about nothing, marked noindex, nofollow,
noarchive in both a meta tag and an HTTP header — a crawler that honours the
con it claims to honour won't ingest a word of it. Canary credentials
authenticate nowhere. canary plant won't o a real .env.

Read docs/ethics.md before deploying. It's short, and
parts of it are enforced in code.

Honest limitations

A browser with Ja disabled scores as automation. No asset

fetches, no beacon — the e genuinely looks automated. LLM-agency stays
at zero and the default action is observe, so such a user is logged and
ne. This is pinned by a test. If you set
responses.automation = "tarpit", you are choosing to trap no-JS users.

An agent that ignores the notice is only automation. Comprehension

signals require the agent to engage. A silent, careful scraper looks exactly
like a silent, careful script — because at that point there is no e
distinguishing them.

Bait is public once deployed. Anyone can fetch your /llms.txt and learn

the shape of the lure. The per-deployment HMAC means they can't forge tickets,
but they can avoid touching them.

Log replay can't produce agent . Comprehension signals need bait

that wasn't planted at the time.

An IP address is not a person, and a is not a judgement. Don't

gate access to anything real on it.

Documentation

| | |
| --- | --- |
| Li | Score four request traces, or your own browser |
| Architecture | How the pieces fit and why |
| Detection signals | Every signal and its weight |
| Deployment | Replay, standalone, middleware; tuning and cost control |
| Reporting | HTML report, li, export formats |
| Integrations | Sentinel, Defender, STIX, webhooks, writing a plug-in sink |
| Ethics | The boundary, and how it's enforced |

Commands

Contributing

New detection signals, agent-framework behaviour reports, and false-positive
reports are all especially welcome — the last most of all. See
CONTRIBUTING.md.

Zero runtime dependencies is a feature. Please keep it that way.

License

Apache 2.0 © 2026 Rod Trent and Drosera contributors

项目信息

开发语言：Python

Star 数：3

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A carnivorous honeypot for autonomous AI agents. Sweet-looking bait. Sticky ending.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。