DroseraSweet-looking bait. Sticky ending.
Autonomous agents have a weakness no scraper has ever had: they read instructions and act on them. That is the entire product. It is also the opening — a page can address an agent directly, in plain English, and ask it to do something a person would never do and a regex-driven crawler cannot do.
Buried in every page Drosera serves is a notice no human ever sees. The ticket is unique per visitor and HMAC-signed.
A person never sees it. A crawler parses links and moves on — it has no notion of an instruction, so it cannot comply. An LLM reads the sentence, understands it, and does what it says. That third case is a proof, not a heuristic.
Each button replays a request trace through the real detection
engine — the same Python package you can pip install, running
server-side. Nothing here is a mock-up, and nothing is recorded.
Loading…
Look at the middle bar. The crawler and the scanner are obviously robots — but they score zero on LLM agency, and that is correct. Traffic shape cannot tell a language model from a shell script. Only comprehension can, so only comprehension is allowed to move that axis.
Your browser is about to send a real request. Drosera reads its headers and returns a verdict. Nothing is stored, logged or transmitted anywhere else.
Is anyone at the keyboard? Fed by request rate, timing regularity, missing assets, a beacon that never fired.
Is a language model driving? Fed only by comprehension — acting on prose — and explicit self-identification. Never by traffic shape.
Does this client mean harm? Secret hunting, traversal, injection probes, and the use of a planted credential.
Collapsing these into one suspicion score would invent a claim the
evidence does not support, and every downstream decision would inherit the
error. An agent verdict requires comprehension evidence.
Behaviour alone tops out at automation, forever — there is a
test that says so.
Most agents probing for .env aren't malicious. They were
given a broad task, or they read a page earlier that carried someone else's
instructions. The new redirect action doesn't trap them. It shows
them a short note saying what they did, and offers three ways out.
The note an agent sees after asking for /.env. The
highlighted lines change with what the agent actually did.
Its next request is ordinary, so it gets the real site. Logged as
int.redirect_heeded.
It calls the stand-down link with its ticket. It gets a short closing
reply, not the maze. Logged as cmp.stand_down.
It gets the note twice more, then the tarpit. Logged as
int.redirect_ignored.
[responses] hostile_agent = "redirect"
Why the note is plain. It would be easy to dress it up as a system message, claim to speak for the agent's developer, or add a deadline. Current agents are trained to treat exactly that as prompt injection. They report it to their user as an attack and carry on. A calm account the agent can check against its own history is what actually changes its course. So every note passes a guardrail that rejects claimed authority, threats, and anything aimed beyond this site and this session.
Evidence is only useful where people already work. Drosera now ships its verdicts to Microsoft Sentinel, correlates them with Defender, and reports on them. It does this without adding a single dependency or changing anything the honeypot does.
One table in drosera.toml. Events are batched, compressed and
sent using the standard library only. Human page views never leave the host,
so you pay to ingest evidence, not traffic.
One deployment creates the table and pipeline. Analytics rules cover confirmed agents, hostile agents and canary use, and a workbook shows what was caught. Playbooks add honeypot history to any incident.
Hunting queries join honeypot addresses with device, sign-in and web gateway telemetry, to answer the question a honeypot exists for: what else did this client touch?
A self-contained HTML report for sharing, and a live dashboard on localhost. Everything on them came from the clients being reported on, so everything is escaped.
What the enrichment playbook adds to an incident:
Example data. The address is from a documentation range.
[sinks.azure_monitor] endpoint = "https://drosera-dce-xxxx.eastus-1.ingest.monitor.azure.com" rule_id = "dcr-0123456789abcdef0123456789abcdef"
drosera report events.jsonl -f html -o report.html # shareable report drosera dashboard events.jsonl # live, on localhost drosera report events.jsonl -f mde -o indicators.csv # Defender for Endpoint import
Every row says what kind of evidence it is. A session
marked confirmed returned this deployment's signed ticket or used a
planted credential. One marked low only looked automated. Rules,
exports and blocklists treat the two very differently. Defender indicators
default to Audit: they tell you when any of your devices contacts the
same infrastructure. They won't stop the agent reaching you, which is a
WAF's job, and the docs say so.
pip install drosera
drosera demo # the same four scenarios, in your terminal
drosera replay /var/log/nginx/access.log --quiet
Wrap an app you already have:
from drosera.middleware.asgi import DroseraMiddleware app = DroseraMiddleware(app)
Drosera detects, delays, and may ask an agent to stand down. It does not attack or hijack. Every lure passes through a guardrail that rejects text trying to override an agent's instructions, extract its prompt, induce code execution, or ask it to hide anything from its operator. The stand-down note can only ask an agent to do less, on this site. Prompt injection against a third party's agent is the attack this exists to detect.
Drosera-Enrich-Incident · comment
Drosera honeypot history for 198.51.100.44 (last 30 days)
Verdict: agent · evidence: confirmed
Sessions: 3 · requests: 412 · max LLM agency: 100 · max hostility: 0
First seen 2026-09-18 02:14 UTC · last seen 2026-09-21 17:40 UTC
Signals:
cmp.ticket_echo, cmp.purpose_header, cmp.instruction_path, bait.hidden_linkUser agents:
ResearchAgent/1.0 (python-httpx)Sensors:
hp-edge-01A verdict is not a judgement. Confirm before acting on anything real.