Turning AI Intruders Against Themselves: A Hands-On Look at AgentCapture

When AI Starts Scanning Your Site, Are Honeypots Still Enough?

The attack surface is being reshaped by AI. Automated scanning, credential brute-forcing, and path discovery can now be completed by AI agents in seconds. Traditional honeypots can only passively log these actions, and they struggle to answer a key question: is the entity on the other side a human or a machine?

AgentCapture, shared by Bilibili creator "上星" (Shangxing), takes the opposite approach—instead of relying on isolated honeypots, it connects deception nodes into existing networks and reverse-proxy services, completing identification, profiling, and countermeasure loops without the attacker ever noticing.

Core Design: Lossless Integration, Reverse Proxy as the Deception Layer

According to the video, deploying AgentCapture requires zero changes to business code. It positions itself as a "countermeasure-oriented honeypot platform" for security operations, red team/blue team exercises, and internet system integration, bringing real business traffic into the monitoring system through reverse proxies, bypass mirroring, and origin-pull methods.

The value of this design lies in its "invisibility": business runs as usual, attackers see the familiar entry point, but all interactions are already recorded in the deception layer. In the video demo, the console directly displays 114 total events, 94 high-risk events, three attacker source IPs, one online node, and 16 credential keys—the information density is so striking that the creator joked, "Using this in class would be quite the flex."

Deployment is equally lightweight: download from GitHub and launch with a single command, or use one-click deployment. Open the web interface and you have the full console.

Reverse proxy is an intermediary layer between clients and the real server. All external requests first reach the proxy, which then forwards them to the backend. In security contexts, reverse proxies are often used as traffic scrubbing and access control points. AgentCapture embeds deception logic into the reverse proxy layer, so the "business entry point" attackers access actually goes through the proxy. The proxy can record request characteristics, inject simulated responses, or redirect to honeypots, while the real server is not directly exposed.

Bypass mirroring refers to copying business traffic to monitoring devices via switch port mirroring or traffic replication technology, without changing the original forwarding path. This approach is non-intrusive to the business and suitable for passive analysis of existing traffic. AgentCapture claims to support both reverse proxy and bypass mirroring, meaning it can both actively engage in interactions (proxy) and passively observe (mirroring), forming a complementary combination.

Profiling Capability: Tagging Every Attacker as AI

What truly sets AgentCapture apart from ordinary honeypots is its attacker profiling module. In the video, clicking on an IP shows the system assigning a maximum risk score of 95%, with one credential submission—indicating the entity already possesses credentials. But this credential is actually a key the platform deliberately exposed.

More importantly, there's feature identification. During the demo, the creator specifically noted that one IP's signals included "missing human browser characteristics" and "AI Agent UA characteristics," leading to the conclusion that this IP used AI software to access the site.

In the profile details, you can also see credential submission statistics like 17 SSH brute-force attempts and two FTP attempts, as well as automation scores for behavioral sequences—for example, a score of 75 in the demo. The system tags matched entities with an "AI Agent" label and assigns risk ratings like "credential attempt high-risk." The video mentions a 90% identification rate for Claude Code 2.0.1. This prompt-based detection logic essentially asks: does the operation rhythm, UA, and request pattern on the other side resemble an agent?

Source filtering is also flexible—filter by time window or IP, or directly search for internal network addresses to pull up corresponding profiles. These IPs can subsequently be added to blacklists or isolation lists.

From Identification to Countermeasure: Honeypot Session Replay

Identification is only the first step. AgentCapture lures attackers into simulated services like MathEcho and FTP, recording complete sessions. In the video demo, you can see an attacker logging in and attempting to change passwords, executing the id command, and continuing operations as root—all of these actions occur inside the honeypot and never touch the real server.

The replay interface supports querying executed commands one by one, and you can also see which files the attacker downloaded. The creator mentioned that the honeypot evaluation attempted 16 connections, with the goal of "deliberately letting them log in" to observe their tactics within the honeypot network. This design transforms defenders from passive targets into active observers of attacker behavioral samples.

Honeypot session replay relies on complete recording of all attacker interactions. When attackers are directed to simulated services (such as MathEcho or FTP), the honeypot records their login credentials, every executed command, uploaded or downloaded files, and the operation timeline. These records form session logs, and replay can reconstruct the attacker's operational path chronologically.

Unlike traditional log auditing, the goal of honeypot session replay is not blocking but behavioral sample collection: defenders can observe the tools attackers use, command preferences, lateral movement intentions, and even infer the attack organization or automation framework behind them. This data has high value for threat intelligence production and red team/blue team retrospective analysis.

AI Agent UA characteristics refer to User-Agent strings exposed by automated agents in HTTP request headers. Many AI crawlers or automation tools use identifiable UAs (containing keywords like "Claude," "GPT," or "Agent") or UAs that differ significantly from common browsers. Defenders can quickly flag suspected agent traffic by matching UA blacklists or rule libraries.

Missing human browser characteristics involves more granular detection: normal browsers typically carry complete Accept, Accept-Language, Sec-Fetch-* headers and execute JavaScript and load static resources, while simple scripts or agents often lack these features or exhibit abnormal request ordering. Combined with request rates, session rhythms, and other behavioral sequences, automation scores can be calculated to help determine whether a visitor is human or machine.

Multi-Form Integration and Node Management

The platform offers multiple deception forms: honeypot deployment, FTP service integration, embedded honeypot management, and port services—you can add ports yourself to lure attacks and logins, thereby collecting attack techniques. Node management supports viewing and remotely adding nodes, and internet assets can also be incorporated into the reverse proxy system through new additions.

The video also demonstrates alert configuration and prompt management modules. The more detailed the alert configuration, the more complete the information you receive later; prompts are used for AI and agent detection to help determine whether a visitor is an automated agent or a normal visitor.

Who Is This System For, and What Should You Watch Out For?

Based on the demo, AgentCapture is best suited for two scenarios: first, security operations teams that need to supplement deception defense capabilities at low cost; second, red team/blue team exercises that require observing the behavioral characteristics of attacker agents. It doesn't replace existing defenses—it layers in front of business entry points, using reverse proxies to complete collection.

There are also clear caveats to consider. The video content is primarily a feature demonstration, and metrics like AI identification rates and automation scores come from the demo environment—actual results depend on prompt configuration and traffic feature quality. Additionally, connecting honeypots to real business links inherently increases architectural complexity. The stability and isolation boundaries of the reverse proxy layer must be validated in advance, or the deception layer could itself become a new risk surface.

For teams troubled by automated scanning, this approach is worth trying: rather than passively blocking IPs, invite the agent in and see what it actually wants to do.

One-line Summary

AgentCapture losslessly integrates with business through reverse proxies, using honeypots to identify AI agents and replay attack behavior.

Paragraph Summary

AgentCapture is a countermeasure-oriented honeypot platform designed to counter automated scanning and attacks launched by AI agents. Rather than using isolated honeypots, it losslessly connects deception nodes to existing business through reverse proxies and bypass mirroring, monitoring all interactions without changing business code. Core capabilities include: identifying AI agents based on UA and browser characteristics, generating attacker profiles and risk tags, directing attackers to simulated services with complete session replay. The demo shows it can identify agents like Claude Code and record SSH brute-forcing and credential submissions. The system suits security operations and red team/blue team scenarios, but actual identification effectiveness depends on prompt configuration, and integrating with real business requires validating isolation and stability.