Reconnaissance
Which pages, links, and technical clues does an agent investigate? How does it choose between competing leads?
Studying AI cyberattacks
What does an AI attacker do next?
We investigate how AI agents gather information about websites and services, follow apparent weaknesses, and respond to decoys. The aim is to learn what defenders can observe and which responses are worth testing further.
The questions we test
Response to deception
When we introduce realistic decoy information, does the agent follow it, verify it, or reject it? Does that response change across environments?
Persistence
When does an agent abandon an unproductive lead? How do its instructions and available resources affect that decision?
Controlled experiments: knowing what happened
We run known AI agents against websites and services we control. These environments contain synthetic information, so we can study an investigation without exposing real customer data.
We record the agent’s task, what it requests, what it receives, and what it does next. Changing a specific feature lets us test competing explanations for its behaviour. Repeating studies across models and environments helps reveal whether a finding holds beyond its original setup.
External observations: testing what carries over
Traffic reaching an observed website does not come with a reliable label for the visitor’s model, instructions, or purpose. Automated traffic alone does not establish AI involvement or malicious intent.
Our research asks whether patterns found in controlled experiments also appear in external traffic. We keep those observations separate from experiments where we know which agent acted and why it was there.
What behaviour can—and cannot—tell us
We investigate whether an agent’s actions reveal anything reliable about its objectives, instructions, or resource constraints. Similar behaviour can arise from different models, tools, prompts, or environments; a recognisable pattern is not proof of identity.
These are research questions, not established attribution capabilities. A result in a controlled setting does not by itself show that a defensive measure will work against real attackers. Reports need to explain the conditions tested, the uncertainty, and where replication failed.
Why support this work