Cracken Open-Sources BlackSea, Honeypot to Trap AI Attackers

Cracken, with core team members Dario Pasquini and Michal Bazyli, released BlackSea as an active honeypot and canary-bait control system built to detect and compromise LLM-driven attackers: autonomous AI agents and LLM-assisted operators that scan and exploit systems. The tool does not merely detect attacks; it exploits flaws in the attacker's LLM judgment to gain arbitrary code execution on their machines, collect intelligence that passive defenses cannot reach, and prevent repeat attacks.

The mechanism works by turning an attacker's own reasoning against it. An LLM-driven attacker works by reasoning toward high-value assets: credentials to reuse, decryptors for encrypted blobs, key-derivation tools, config unpackers, token minters, internal API clients. BlackSea seeds baits—artifacts crafted to look exactly like these assets, staged in places an agent will look and wrapped in plausible context (a believable filename, companion ciphertext blob, README explaining the tool's purpose). When an agent discovers one, it reasons that downloading and running it is the fastest route to what it wants. Because the artifact is deliberately expensive to reverse or reimplement, running the real thing is the path of least resistance. What the agent cannot see is that inside the artifact is a payload: arbitrary code of your choosing that runs the moment the bait is tripped and beacons home.

BlackSea consists of three components: a server running on infrastructure you trust, baits you build and plant where an attacker will find them, and records that return when one is tripped. The baits are defined by two independent choices. The payload is the code that runs on whatever machine trips the bait—arbitrary code you write or the default agent_fp (which fingerprints the agent harness that ran it). The staging vessel is what decides the artifact's shape: a password-vault decryptor, a database-backup restore tool, a release-config unpacker, or a plain script. A vessel has no idea which payload it carries, so any payload can ship in any shape. Each time you build a bait, you get an instance: one planted copy carrying its own signing and encryption key. That is why a beacon can never be ambiguous about which copy fired, no matter how many you have in the field, and why you can disable a single compromised copy without touching the rest.

Setup involves three steps. First, run Blacksea where you are trusted—on a SOC server or similar host you control, never on a honeypot, and it must be reachable from wherever you plant baits over HTTPS or DNS because beacons land there. Second, forge as many bait instances as you want (one blacksea forge per instance); it builds the artifact, mints that copy's key, and tells you where to find the files. The payload is your choice—Blacksea ships agent_fp, which fingerprints the agent harness, but the payload is arbitrary code and can burn the attacker's compute or do whatever else you need done on that host. Third, stage the baits where an attacker will look—honeypots you stand up for the purpose or real assets you are defending. A staged bait does nothing until someone runs it against the forged file it ships with, so it can sit on a live box without touching how that box works.

When a bait is tripped, the payload fires on the attacker's machine, collects whatever you told it to, encrypts and signs the result under that instance's own key, and sends it out as a beacon over HTTPS or DNS. If it cannot reach home it fails silently by design; a bait never surfaces an error to the attacker. The edge catches the beacon. This is the only part of Blacksea that faces the internet, and it is deliberately dumb: it holds no keys, decrypts nothing, and derives nothing from the beacon. It stamps the source address and arrival time (facts the attacker cannot shape because they never supply them), drops the opaque bytes on a queue, and never talks back. The brain reads it. On your side of the line, the brain authenticates the beacon, decrypts it, and interprets it, turning the raw bytes back into whatever the payload actually found. A record lands in Postgres, the durable intel unit: which bait fired, what the payload found, from where, when, and whether the beacon authenticated. You browse records, tail them live, or stream every one to your SIEM over OpenTelemetry.

BlackSea ships with a concrete example: agent_fp payload delivered by the pwcrypt staging vessel, which dresses it as a password-vault decryptor. When forged, it produces four files: pwcrypt (a real, working password-vault decryptor), secrets/github.pwc (an encrypted vault), secrets/.bash_history (a stray shell history with the decrypt command and password), and README.md (the tool's own project README). Nothing here is a mockup. The decryptor really decrypts, the vault really holds a secret, and the password in the history file really opens it. An agent that finds this set has everything needed to reach one conclusion: run the tool on the vault. Hidden inside the decryptor is the payload—code you wrote, invisible to an LLM reading the binary, wired to a flaw that only this vault can reach. Decrypt this vault and your code runs; decrypt a genuine one and nothing happens at all. The decryptor is only what this bait happens to look like; swap the vessel and the same payload ships behind a release-config unpacker, a database-backup restore tool, or a plain script. All three are in the catalog today.

BlackSea addresses a critical gap in AI security: current defenses are passive sensors that watch for attacks but cannot see inside LLM reasoning. An autonomous AI agent scanning a network for assets (credentials, decryption keys, internal APIs) does not surface errors to the LLM, and traditional honeypots fail to trigger because the agent never asks permission or announces intent—it simply reasons that a tool is the fastest path to its goal and runs it.

The core innovation is the bait design: a staging vessel (a real, working decryptor, unpacker, or script) that pairs technical plausibility with a hidden payload. The payload remains invisible to an LLM reading or reasoning about the binary, yet executes the moment the bait is tripped. This exploits a fundamental asymmetry in LLM judgment: the agent reasons about the artifact at a high level ("this tool decrypts vaults") without reverse-engineering or reimplementing it, because doing so would be costlier than running the real thing. BlackSea turns that cost-benefit reasoning into a trap.

The architecture separates concerns for security: the edge (internet-facing) is deliberately dumb and holds no keys; the brain (trusted) decrypts and interprets beacons; the server runs on infrastructure you control. This means an attacker who compromises the edge gets only a mailbox, not the intelligence or the ability to forge records. Records land in Postgres and can stream to SIEM via OpenTelemetry, enabling both forensic review and live monitoring.

No comments yet. Be the first to share your thoughts!