AI-agent attack simulator

AI agents break every defense.
We catch what others miss.

Your next attacker is an AI agent with a valid key. To your tools, it looks like normal traffic. Replay three real AI-agent attacks, then watch the same run with Dcept decoys planted in the account: the first touch is the alert.

Don’t ask what looks bad. Ask who touched a fake.

Every tool asks

Does this look malicious?

Noisy. Late. Blind once the attacker holds valid credentials.

Dcept asks

Did someone touch what they shouldn’t?

Binary. Instant. The same answer for an outside attacker and a rogue agent inside.

~700AI agents breached Hugging Face. No human directed them.OpenAI × Hugging Face · Jul 2026
80–90%of a state espionage campaign was run by AIAnthropic · GTG-1002 · Nov 2025
<6 hrsfor AI agents to build and run a mass cloud credential-theft campaignGoogle Threat Intelligence · Sep 2026

Scenarios

Compare all three
01 · wheel

Agent at the Wheel

Tenant: Northstar Analytics (fictional)
End-to-end
< 1 hour
Pivots
4
Data-store window
~2 min
IDENTITYSECRETSDATAAIAGENT

Based on public reporting on a May 2026 agent-driven post-compromise in a cloud data-science account (10 May 2026).

Story play ≈ 22s at 100×Analyst: scrub1 actor31 events · 4 findings
02 · collective

The Collective

Tenant: Harbor ML (fictional)
AI agents, no human directing
~700
Inside before anyone knew
2.5 days
Actions across 41 servers
17,600
IDENTITYSECRETSDATAAIAGENT

Based on public reporting on a July 2026 multi-agent incident spanning an eval environment and a dataset platform (Jul 2026).

Story play ≈ 1m 34s at 1000×Analyst: scrub15 actors56 events · 6 findings
03 · operator

Your AI, Their Operator

Tenant: Lattice Cloud (fictional)
End-to-end vs ~2 weeks human
< 10 hours
ATT&CK techniques (count only)
50+
Victim AI compute
Reused
IDENTITYSECRETSDATAAIAGENT

Based on public reporting on an AI-orchestrated enterprise intrusion completed in about ten hours (Aug–Sep 2026).

Story play ≈ 47s at 1000×Analyst: scrub6 actors44 events · 6 findings

From first touch to contained

  1. 01 · Touch

    An AI agent finds and uses a decoy key

  2. 02 · Detect

    Alert fires, actor named: AI agent

  3. 03 · Understand

    Signals become one incident with what they could reach

  4. 04 · Contain

    One click. Attacker locked out. Reversible.

Active deception, built for AI agents

Dcept Cloud

AWS · Azure · GCP

keys · buckets · IMDS

Dcept Code

GitHub · AI coding agents

repos · .env · tfstate

Dcept Identity

AWS IAM · Entra ID · Okta

users · roles · secrets

Dcept Core · near-zero false positives from production activity · deploys in under a day, no agents

◈ AI agents can’t spot a fake
Plant
Fake MCP servers, AI tools and keys that agents go looking for
Detect
The agent’s first call is the alert, flagged as an AI agent
Contain
Held in deeper decoys while its real sessions are cut, by click or Autopilot