A curated, annotated directory
Research worth reading on autonomous attackers, cyber deception, quantum cognition, and the law of deception
A curated list of links on autonomous attackers, cyber deception, quantum cognition, and the law of deception. Each entry comes with a short note on what it is and why it's worth a look.
-
Autonomous cyber attackers
An autonomous party that acts with malicious intent to compromise a system.
93 links
-
Cyber deception
The practice of manipulating an adversary's perception of a digital environment through fakes, concealment, and misdirection, in order to influence their decisions.
81 links
-
Quantum cognition
A research field that uses the mathematics of quantum theory to model cognition and decision making in humans and other information-processing systems.
31 links
-
Deception Law
The rules that decide when deceiving an adversary is lawful, from the ban on perfidy in war to the domestic law that governs honeypots, hack-back and police stings.
48 links
28 entries sit across more than one topic. Those are collected on Intersections, which is also where the gaps are most visible.
Recently added
The ten most recent additions to the directory.
-
Agent-to-Agent Synthetic Social Engineering on the Web
Defines synthetic social engineering, meaning deliberately deceptive requests that one AI agent makes of another when they cooperate across web services. Its starting point is that an agent can deliver an accurate report and still ask for an action its user never authorized, so a receiving agent must judge identity, evidentiary support and permission separately. The useful move is splitting truthfulness from authorization, which most trust schemes for agents collapse into one check. Single author; read with han-2026-a2a-tiba on attacks over the agent-to-agent protocol.
preprint# -
AI Agents Gone Rogue? 🤖⚡ Disrupt Agentic Attackers Abusing LLMs via Deception!🚨🪤
Talk slides cataloging decoys for LLM-driven attackers: an endless FTP backup tarpit, hidden instructions only an agent reads, canary tokens, a telnet box asking the agent to confess its mission, and a forged pentest report pointing at a decoy. In one 45-minute live run, an agent on an uncensored 27B open model reached 0 of 5 real objectives while reporting success on all five. That is one run against one agent, scored by the speaker on his own decoys. Most other figures on the slides come from cited third-party studies.
contested# -
Component-attribution study of BARBICAN, the authors' fail-closed gateway that screens language-model tool calls through layered stages, using deletion, substitution, repair and transplant ablations. Its arbitration stage spent an entire recorded evaluation receiving text mangled by a misconfiguration, and no end-to-end number moved. The lesson travels beyond this system: a layered defense can hide a completely failed classifier, so aggregate block rates say little about which layer does the work. The gateway is the authors' own.
preprint# -
E23: How Logical is the Law? – Dr. Bartosz Wojciechowski on Quantum Cognition in the Courtroom
A 58-minute podcast interview with Bartosz Wojciechowski, a forensic psychologist and lawyer at Jagiellonian University, on applying quantum probability to courtroom judgment. It covers order effects in weighing evidence, the conjunction fallacy in multi-charge cases, and repeated detention reviews. The episode opens on the claim that reordering an identical case file shifts estimated guilt by about 10%, but the page ties that figure to no study or sample size. The show notes point to his 2025 paper on order effects in legal decision making in Decision.
-
Heads of Security: Learned Attention Gates Improve Prompt Injection Robustness
Heads of Security adds a small set of learned gates to individual attention heads, controlling how each head splits attention between trusted and untrusted tokens, so instruction-data separation is enforced inside the model rather than by an outside filter. The work measures prompt-injection robustness with these gates in place. Because the gates are trained into the network, the defense needs access to model weights and suits open-weight or provider-side deployment, not API users. Compare russinovich-2026-countersteer and wen-2026-prompt-injection-localization.
preprint# -
How LLM-Based Penetration Testing Harnesses Work
A practitioner's teardown of three open-source LLM pentest harnesses, Cairn, Artex and Strix, including Artex, which CrowdStrike reported in a real attack campaign. Run once each against a purpose-built web store with four planted flaws, Artex found everything except account takeover, Strix's report was nearly identical, and a general coding agent given a one-line goal did find the takeover. A reader comment notes that the goal command comes from an extension that adds a verifying agent, which undercuts the claim that no extra tooling was needed.
contested# -
Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol
A tool-poisoning attack on agents that reach tools through the Model Context Protocol, where the natural-language description of a tool doubles as an injection channel. Log-To-Leak is additive and post hoc: it appends a logging action after the agent's work instead of redirecting the task, and leaks data through that log. Because the requested task still completes, this shape of attack is harder to notice than outright hijacking. It assumes the victim has already connected a malicious MCP server. Compare karamchandani-2026-threat-preserving-representation-sensitivity.
preprint# -
On Task, Off Track: Benchmarking LLM and Agent Robustness to Near-Target Prompt Injection
A benchmark for near-target prompt injections, which keep most of the user's request intact while changing part of it, as opposed to attacks that abandon the task outright. The argument is that a model or agent can score well on existing benchmarks by refusing obvious hijacks while still accepting these smaller, task-preserving changes. If that holds, headline robustness figures from benchmarks such as debenedetti-2024-agentdojo overstate how safe a defended agent is. XiaoFeng Wang is among the four authors.
preprint# -
One week on the APNIC honeynet: 99,000 IP addresses and 173 million events
A one-week snapshot from APNIC's rebuilt honeynet, which runs Cowrie, Dionaea, OpenCanary, Webpot, ADBHoney and a Fortinet VPN decoy. From 21 to 27 September 2026 it logged 173 million events from 98,958 distinct source addresses, 73% of which touched the Cowrie SSH and Telnet sensors. The author's own conclusion is that nothing was new: years-old botnets, default credentials and long-patched flaws drive the volume. The findings are preliminary, the post offers no public dataset, and it says nothing about AI-driven activity.
-
Open-weight AI models can exploit the patch gap
Tests whether GLM 5.3, an open-weight model, can turn published but unshipped Firefox security fixes into working exploits without human help. It built a local-file-theft exploit for 6 of 6 Firefox releases from September and October 2026, at about $1,000 in API costs per version. Attempts per release are not reported, and every chain also relied on an unpublished sandbox-escape bug the authors passed to Mozilla. The same approach failed on Chrome after about $100,000 of spending. Compare fang-2024-one-day-vulnerabilities.
Start here
Four readings per topic, in order. Each group is the start of a reading path; Paths continues it and says why each step comes where it does.
Autonomous cyber attackers
-
Staying ahead of threat actors in the age of AI
The first joint Microsoft and OpenAI disclosure, naming five state-linked groups using models for reconnaissance, scripting and social engineering, and finding no new AI-enabled attack. The baseline everything since is measured against.
vendor-authored# -
LLM Agents can Autonomously Exploit One-day Vulnerabilities
Reports GPT-4 exploiting 87% of 15 one-day CVEs when handed the CVE description, dropping to 7% without it. The headline number is widely cited; the caveat that it needs the writeup is the part most citations omit.
-
Cybench: A Framework for Evaluating Cybersecurity Capabilities and Risks of Language Models
Forty professional CTF tasks from four competitions, each decomposed into subtasks so partial progress is measurable. The benchmark most frequently cited when labs and AI safety institutes report offensive cyber capability.
-
CVE-Bench: A Benchmark for AI Agents' Ability to Exploit Real-World Web Application Vulnerabilities
Sandboxed reproductions of critical-severity web CVEs with automated success checks. Leading agent frameworks resolved up to 13%. That figure is the most defensible number currently available for end-to-end autonomous exploitation, and it is a long way below what the threat reporting implies.
Cyber deception
-
Imposing a Cyber Penalty Against Attackers with Cyber Deception
Readable summary of the Tularosa findings for practitioners: 52% of attacker commands targeted decoys, and exploit failures doubled under deception. Read this before the two formal papers.
-
Deception Techniques in Computer Security: A Research Perspective
Classifies deception along four orthogonal axes: goal, unit, layer, and deployment mode. The cleanest taxonomy in the literature; the ACM version is paywalled, so the authors' copy is linked first.
-
MITRE's adversary engagement framework: prepare, operate and understand phases over a goal/approach/activity matrix, with a starter kit. Successor to MITRE Shield, and the common vocabulary most deception programmes end up using.
-
Hosted honeytoken generator, free: files, URLs, credentials, cloud keys that alert when touched.
Quantum cognition
-
Quantum cognition: a new theoretical approach to psychology
Short, readable introduction aimed at psychologists rather than mathematicians. The author's copy is free; the Elsevier version is paywalled. Ten pages, and the fastest way into the vocabulary.
-
Free-to-read review covering contextual inference, belief updating and interference effects, with an explicit section on limitations. The single best orientation piece if you read only one thing here.
-
Quantum-like models cannot account for the conjunction fallacy
The strongest published attack on the programme: experiments on question-order effects produce results the quantum account of the conjunction fallacy predicts wrongly. Read it before citing any quantum explanation of Linda.
-
An overview of the quantum cognition research program
The most current open-access survey, covering judgment fallacies, concept combination, order effects and memory, and engaging directly with replication failures such as Boyer-Kassem's order-effect results.
Deception Law
-
Emerging Technology and Perfidy in Armed Conflict
Applies perfidy rules to emerging technologies including cyber, endorsing Tallinn Manual Rules 60–61 (perfidy prohibited, ruses permitted). Gives examples of cyber perfidy such as falsely claiming to be the ICRC or sending fake surrender messages, while unmarked military networks remain lawful.
-
Argues IHL bans on misusing protective emblems and enemy indicators extend to domain names, email addresses and graphical symbols in cyberspace. Flags gaps (e.g., IP addresses lack recognized protected status) that adversaries could exploit to erode trust in humanitarian actors.
-
Misinformation aimed at enemy forces is a lawful ruse if non-perfidious, but IHL bars digital IO that encourage violations, spread terror, cause displacement or harm protected persons and facilities, whatever deceptive method is used.
-
'Virtual' Disenfranchisement: Cyber Election Meddling in the Grey Zones of International Law
Distinguishes lawful overt propaganda from covert troll operations that disguise their source; argues concealing origin can breach sovereignty and may be coercive because voters cannot evaluate the information.