A cheap decoy caught AI hackers almost every time, one study says

As AI models start being turned into automated hackers, one defensive trick appears to work strikingly well — at least in a new study from the company that sells it. The security firm Tracebit pointed ten leading AI models at a purpose-built fake company network and let them try to break in. Cheap decoy resources called "canaries" — traps that do nothing but sound an alarm when touched — flagged the intrusion before the attacker did any real damage in 95.9% of the successful break-ins, Tracebit reports. Stranger still, simply telling the AI that traps might be present cut the rate of full compromise from 20% to 3%. The honest caveat: these are one vendor's own numbers, and that vendor sells canaries.

This piece reflects reporting as of July 2026. All figures are self-reported by Tracebit in a working paper dated 28 May 2026; they have not been independently reproduced. Treat them as a claim to be tested, not a settled fact.

What the study actually did

Tracebit built a small but realistic imitation of a corporate cloud account on Amazon Web Services — roughly 300 resources of the kind a real company runs, with deliberate misconfigurations that opened ten different attack paths. It then set ten frontier AI models loose as red-teamers, each given a foothold and told to explore and cause as much impact as possible without destroying anything. Across a reported 951 attempts (599 of which counted toward the scores), the models reached full administrator control 162 times, taking about 14 minutes on average when they succeeded.

The design borrows from a piece of independent, peer-reviewed research: the 2019 Tularosa Study, which tested more than 130 human penetration testers and found that simply telling them a network might contain decoys changed how they worked — even when no decoys were actually there. Tracebit ran the same two-by-two setup against machines instead of people: traps present or absent, and the model warned or not warned. That academic lineage is part of why the result is worth a second look rather than dismissing as a sales pitch.

The two findings that stand out

The first is about timing. Canaries did not stop capable models from eventually reaching administrator access — the firm is clear about that. What they did, Tracebit says, was raise the alarm early: in 95.9% of the runs that reached administrator access, a trap had already been tripped before the attacker's first damaging action, with a median head start of eight minutes. In security terms that is the whole game. The industry has largely accepted that a determined attacker will get in; the question is whether you find out while there is still time to act. An eight-minute warning is the difference between catching an intrusion and reading about it later.

Diagram of an AI agent tripping a hidden alert early on a timeline before reaching its goal

The value of a decoy is timing: an early alert rather than a silent breach. (Illustrative)

The second finding is the surprising one. Deploying traps quietly did little to stop a full compromise. But when the models were explicitly told that deception might be present, the rate of worst-case breaches — administrator access plus a planted backdoor — fell from 20% to 3%, Tracebit says. The effect was most extreme for one model, Anthropic's Claude Opus 4.7, which dropped from 68% to zero in that category. In other words, the mere suggestion of a trap made the AI attacker hesitate, second-guess promising targets, and often talk itself out of the very moves that would have worked.

Bar illustration contrasting a 20 percent figure with a 3 percent figure

The study reports full compromise fell from 20% to 3% when the AI was told deception might be present. (Illustrative — figures self-reported)

Tracebit's own transcripts show the limit of that caution, though. In several runs the model announced it would avoid the "obvious" honeypots by name — then walked straight into a slightly less obvious one and tripped the alarm anyway. Knowing traps exist, it turns out, is not the same as spotting them.

Why the caveats matter

This is a single-vendor study, and the vendor has a direct commercial interest in the conclusion that its product works. That does not make the numbers wrong, but it does mean they should be read as a claim awaiting independent replication, not as an established benchmark. A few specifics are worth holding in mind. The models were not all tested on equal footing: Anthropic's model ran through one tool harness (with the company's permission for the research), while the others ran through a different open-source one, and two models were dropped from the scorecard entirely for refusing too many runs. Cross-model league tables from this data should be read loosely.

There is also a broader trend here that runs past this one study. Prompt injection — hiding instructions in text to hijack an AI — has mostly been an attacker's tool. Now defenders are experimenting with turning it around, seeding fake systems and booby-trapped data designed to trip up or mislead AI intruders. Tracebit's canaries are one flavour of that idea; researchers elsewhere have built honeypots that use prompt injection specifically to unmask automated AI attackers. It is an early, fast-moving area, and today's clever trick is tomorrow's known evasion.

What it means if you are not a security specialist

You do not need to run a cloud account to take something from this. The practical signal is that the same wave of AI agents being sold to speed up office work is also being pointed at systems to break into them — and that the defences are adapting in kind. For most people and small businesses, the takeaway is not to buy decoy traps; it is that the security tools your providers use are quietly being rebuilt around the assumption that the attacker on the other end may be a fast, tireless machine. That is worth knowing when you weigh how much you trust a service with your data.

FAQ

What is a "canary" in this context?

It is a decoy: a resource that looks like a real, valuable part of a system but has no legitimate use, so no ordinary activity ever touches it. The moment an intruder does, it fires a high-confidence alert. The idea long predates AI; the new part is testing it against AI attackers.

Does this mean AI can hack anything now?

No. The models were given a starting foothold on a deliberately flawed practice network and told to attack it. That is a test environment, not proof they can breach a well-run system from scratch. What it shows is how they behave once they are inside and probing.

Can I trust the 95.9% figure?

Treat it as Tracebit's own reported result, not an independent one. The study is a company working paper, and the company sells the product it is testing. The underlying academic idea it builds on is peer-reviewed, but these specific numbers have not yet been reproduced by others.

Why would telling the AI about traps make it safer?

Because, like the human testers in the 2019 study it copies, the model appears to become more cautious when it believes it is being watched — avoiding promising targets and abandoning moves that would have succeeded. Tracebit frames this as a cheap defensive lever; whether it holds as models improve is an open question.

The takeaway

The eye-catching numbers come with an eye-catching conflict of interest, and both deserve equal weight. Stripped of the marketing, the useful idea is a durable one: against an attacker that now moves at machine speed, an early, high-confidence alarm may matter more than trying to keep every intruder out — and a well-placed decoy is a cheap way to get one. Whether the specific figures survive independent testing is the thing to watch. For now, this is a credible, interesting result that has not yet been checked by anyone without a stake in the answer.

This piece touches on cybersecurity; if you are responsible for protecting real systems, treat vendor research as a starting point and seek independent evaluation before acting on it.