Defenders have used deceptive tactics to safeguard networks for 40 years. Clifford Stoll set the pattern in 1986, holding an intruder on the line at Lawrence Berkeley National Laboratory with a directory of fabricated defense documents, an exploit he describes in The Cuckoo’s Egg. Deceptive practice moved from there to the Honeynet Project, which formalized honeypots, or traps, in the late 1990s, and on to today’s enterprise deception platforms.

In that time, the basic idea hasn’t changed: Attackers act only on what they perceive, and defenders can aggressively shape that perception. What has changed is that today’s attacker is increasingly powered by an AI model interpreting and navigating an environment, rather than just a human intruder drawing on their experience. The time is now to refresh this proven playbook by using counter AI to counteract the attacker’s velocity.

As we detailed in our recent report, When Cyberattacks Happen at AI Speed, AI-powered attacks happen significantly faster, creating an asymmetry in cyber operations. AI accelerates all facets of the cyber kill chain, including reconnaissance, exploitation, and lateral movement. While defenders can harness AI as well, workflows remain inherently reactive, and essential AI security guardrails limit model flexibility and agility. Although defensive workflows can still work, they carry less margin for error when the attack cycle outruns the decision cycle.

Speed also costs the attacker something, and that’s where defenders can look for a new advantage. An autonomous agent rapidly interprets its environment through AI model-driven cues: read what is there, judge what matters, pick tools, and plan the next step. It weighs what it was given and moves on—a behavior defenders can exploit. Shaped context influences machine decisions the same way it has always influenced human ones, and defenders control most of the environment an attacker’s AI has to read.

Counter-AI strategies exploit the adversary’s reliance on this AI-driven interpretation and decision making. By shaping what the attacker’s AI sees, trusts, and acts on, defenders can collect telemetry, redirect the session, or trigger containment before the attack reaches real assets.

Organizations can now adapt false credentials, decoy services, planted files, poisoned reconnaissance data, and controlled routes away from production to thwart autonomous adversaries. When employing counter-AI methods, deception becomes the means to deliver the solution. As the adversary consumes defender-curated content, the adversary’s agents will feed specific model breaks back into the attacker’s engine. While traditional deception looks to distract or uncover the attacker, counter AI uses deception as AI traps, targeting an agent’s reasoning loop for systemic failures and critical intelligence collection.

Some traps act as lures that attract attention: a credential, file, or service that falsely reads as a foothold. Some burn time, holding an agent in a path that produces nothing. Others track and expose methods, showing how the agent reasons, the tools it uses, and even the human-curated prompts that initiated and controlled the campaign. Some traps can even control the attacker’s AI, orienting it to believe defender deceptions are its critical infrastructure and exfiltration source. 

This results in rich intelligence and the opportunity to manipulate, redirect, or co-opt the model. End to end, when an agent engages, defenders collect telemetry, redirect the session, or trigger containment while the attack is kept separate from real assets.

Of course, a network full of random traps isn’t a defense. Deception starts with intent: a playbook that specifies where traps go, which attacker behaviors they should provoke, which signals matter, and what happens when one fires. Placement follows sensitivity—extended engagement in low-risk areas to gather intelligence, fast action near critical systems. The toolkit spans decoys, canaries, fake credentials, tarpits, misleading artifacts, and disruption techniques.

During an attack, a counter-AI engine executes that playbook: monitoring trap activity, collecting telemetry, adjusting within defined limits, and invoking controls already in place, such as endpoint isolation or firewall blocks. Near a high-value system, that might mean seeding credentials that pull an attacker toward a decoy service, watching how they behave, then triggering containment.

Over time, a learning loop keeps the system current—testing models against the traps, finding where agents misread their environment, and feeding those failures back into new playbooks.