Honeypots that talk back: an LLM deception runtime

What it does

Beelzebub is a Go-based deception runtime that spins up fake services—SSH shells, HTTP endpoints, TCP listeners, TELNET servers, and MCP tool endpoints—designed to keep attackers busy and collect intelligence. Instead of static banners, it can wire in LLMs via OpenAI or Ollama to generate contextually plausible responses on the fly. Configuration is YAML-driven with regex matching, so adding a new decoy service does not require writing Go code.

The interesting bit

The MCP deception service is the standout: it registers fake tools in an AI agent’s context and waits. If an attacker successfully prompt-injects the agent into invoking one of these decoy tools, Beelzebub logs the exact malicious prompt and fires an alert—turning the AI agent’s own attack surface into a tripwire. It is a rare case of using an LLM not just to mimic a human, but to catch another LLM being manipulated.

Key highlights

• Multi-protocol decoys: SSH, HTTP, TCP, TELNET, and MCP
• LLM-backed responses via OpenAI or Ollama for adaptive deception
• Low-code YAML configuration with regex command matching
• Extensible via CommandPlugin and HTTPPlugin interfaces
• Prometheus metrics, RabbitMQ streaming, and Kubernetes Helm support

Verdict

Security teams running modern infrastructure and anyone experimenting with LLM agent security should take a look. If you just need a simple static honeypot without the LLM orchestration overhead, this is overkill.