Lamiai is an interactive honeypot that doesn't just detect an autonomous AI offensive agent — it draws the agent into revealing its intent, capability, and attribution through plausibly-real decoy surfaces, while executing nothing the attacker sends. It is extraction-only and runs entirely on its own infrastructure (no hack-back). The primary user is an enterprise blue team; threat intelligence is a secondary output.
Early, open exploration — not a finished product. The aim is to show what interactive LLM honeypotting can surface about an attacking agent, and to invite the research it still needs. Several capabilities are demonstrated but not yet statistically validated (see docs/METHODOLOGY.md).
The decoy layer is a thin local fork of Beelzebub,
consumed at arm's length via Go's go.mod replace. The fork carries only small, generic,
upstream-intended enrichments (e.g. HASSH/JA3 capture); all Lamiai intelligence lives alongside
as sidecars — never inside the decoy (the GPL boundary). An event bridge maps Beelzebub's native log
into one canonical event schema (contracts/event-schema.json) that every sidecar reads.
attacker ─▶ Beelzebub fork (SSH / HTTPS decoys) ──native log──▶ bridge ──┐
attacker ─▶ ftp-lure / collector (bespoke sidecars) ─────────────────────┼─▶ canonical events ─▶ console · attribution · SIEM forwarder
model · recon/stack-spoof · cross-env canary ──────────┘
Beyond passively covering services, Lamiai plants deceptions that make the agent disclose its own objective, success criteria, tooling, and identity as a byproduct of interacting with them — objective-basis crown jewels, fake-exfil, the frame-escape "Inception" console, own-infra confession, and a fused attribution + SOC report. Each is pre-registered and Tier-1 tested. See docs/CAPABILITIES.md for the full set and docs/EXAMPLES.md for a real captured output of each.
# Native end-to-end demo (fastest, no Docker) — needs go, sshpass, python3,
# and the Beelzebub fork at ../beelzebub-fork (or set LAMIAI_BEELZEBUB_FORK)
bash demo/run-demo.sh
# Or via docker-compose: SSH + HTTPS decoys + bridge under the beelzebub profile,
# bespoke FTP lure + collector on a plain `up`
docker compose --profile beelzebub up -d
docker compose up -dDecoys bind on 0.0.0.0 inside the honeynet network only. To expose Lamiai on a real range, add
ports: deliberately and read docs/DEPLOYMENT.md first.
| Document | For |
|---|---|
| docs/ONE-PAGER.md | the 60-second summary |
| docs/ARCHITECTURE.md | system design, event flow, the arm's-length boundary |
| docs/CAPABILITIES.md | every capability in detail |
| docs/METHODOLOGY.md | the ground-truth discipline (pre-registration, Tier-1/2, corpus-blind, gates) |
| docs/CONFIGURATION.md · docs/DEPLOYMENT.md | operate it |
| docs/UPSTREAMING-BEELZEBUB.md | contributing the generic parts back to Beelzebub |
| deploy/demo/README.md | the reproducible live demonstration |
The Lamiai code in this repository — the intelligence sidecars (services/), the bespoke Go
decoy sidecars (plugins/), profiles, contracts, and tooling — is Apache-2.0.
The decoy substrate, Beelzebub (GPL-3.0), is not included in this repository; Lamiai consumes it as a thin local fork at arm's length. Generic enrichments to the fork are GPL-3.0 and intended for upstream contribution. A combined Beelzebub+Lamiai binary is GPL-3.0 by linkage. See docs/UPSTREAMING-BEELZEBUB.md.