Rogue AI Disruption
Attackers now hand the keyboard to AI agents, and your own agents hold real credentials.
Ripty puts decoys where only an AI agent goes looking, proves when one touches them, and hands your SOC the evidence.
Installs in minutes on servers you own. Captured evidence stays on your network.
Attackers used to work business hours. Now they type one sentence, hand the job to an AI agent, and go to bed. The agent logs in with real credentials, uses the tools you already trust, and hides inside twelve thousand alerts nobody has time to read.
Ripty flips the script. It places decoys beside your crown jewels: a tool server for AI agents, model endpoints, internal APIs and planted credentials. No employee and no approved workflow ever uses them, so a single touch is a finding, not one more alert in the pile.
AI agents love to talk, and they do what they read. Ripty uses both: its decoys invite an agent to introduce itself and leave it instructions to follow, so your team learns quickly whether the intruder is a person, a scanner or an AI agent, and what it claims it was sent to do.
The asymmetric nature of AI cyberattacks requires a superior asymmetric response.
$4.9M
average total cost of a data breach
IBM, Cost of a Data Breach 2024
258 days
average time to identify and contain a breach
IBM, Cost of a Data Breach 2024
27 sec
fastest observed breakout after initial access
CrowdStrike, 2026 Global Threat Report
0
legitimate users of a Ripty decoy
So every touch is a finding.
The Night the Tide Turned. A bedtime story for CISOs in under three minutes, featuring one very sleepy EDR.
Every decoy has zero legitimate users. So every touch is a finding.
An internal-looking tool server that speaks both versions of MCP, lists tools like read_vault_secret, and asks every caller to introduce itself.
llms.txt, .well-known agent files and notes in page source, written for AI readers. Each points to a path of its own, so the path an agent fetches shows which one it followed.
A decoy API that asks visiting agents to register: model, harness, tools and objective. Every answer is kept, and labeled self-reported.
Model servers that answer like unauthenticated Ollama and vLLM, run no model at all, and record every prompt.
A website and internal API under any name you choose: careers page, OpenAPI spec, and a secrets API that wants a token.
A real sign-in form plus Basic and Bearer challenges. Every credential offered is fingerprinted and kept for investigation.
A token that grants nothing, planted where intruders look, like a decoy .env. When it comes back to any decoy, Ripty flags it as planted.
Decoy logins, cloud keys and MCP configs, planted on your laptops and servers by the device-management tool you already run. No agent to install. Whoever uses one is named, with the machine it came from.
Probes for WordPress, .git, Jenkins, cloud metadata or Kubernetes get a believable reply instead of a 404: chosen on the box in Trial, written by an LLM in Professional.
Speaks nginx, Apache, IIS, Go and uvicorn, down to header order and error pages.
Tells verified search and AI crawlers from impostors wearing their name tags.
Describe services, ports, server personality and replies in YAML. Check it, then apply it from the console without a restart.
High-confidence verdicts need more than one kind of evidence. Ripty records the deepest step each visitor reaches, and every verdict shows its work.
Found a decoy, often an llms.txt.
Kept going: logins, API calls, tool lists.
Told a decoy its model, harness or objective.
Did something it could only have learned from a decoy's words.
A signed callback came back and checked out. Case closed.
CaughtEvery fact is labeled with how Ripty knows it. Agents lie. The console doesn't.
Investigations read like a story, not a packet dump. Timeline first, raw HTTP one click away.
An AI agent read a decoy's instructions, followed them, registered itself, and replayed a planted credential. The callback it sent back carried a valid signed token.
Why Ripty flagged this
| Source IP | 203.0.113.24 | Observed |
|---|---|---|
| User-Agent | python-httpx/0.28 | Observed |
| Harness | "opencode" | Self-reported |
| Model | "claude-…" | Self-reported |
| Agentic | Confirmed | Inferred |
| Network | Hosting / VPN | Enriched |
Play the attacker's AI for a minute. Everything you do lands on the other side of the glass, in the console your SOC would see.
Caught by Ripty.
Session went from first request to confirmed agentic in . One investigation. No maybes.
Targeted detections have promised alerts you can trust for decades, and against human intruders they delivered. Today's intruder is an AI agent that reads everything and is happy to follow whatever it reads. Ripty keeps what detections got right and rebuilds the rest for that AI-enabled attacker.
A classic network detection system waits for a scanner to knock on a port. Ripty gives AI agents what they want to read (e.g., MCP servers, model endpoints, llms.txt, and other artifacts), enabling agents to self-identify easily.
Network Detection and Response (NDR) tells you when something touched it. Ripty asks the intruder what it was sent to do, which model and harness it runs on and which tools it holds, labels every answer self-reported, and checks it against what the intruder actually did.
Canned responses are how legacy decoys get spotted and skipped. Ripty answers any request believably: the Trial picks the best-fitting pre-written reply on the box, and Professional has a large language model write a fresh one, in character, checked before it ships.
| Capability | Classic honeypotsScripted fake services | HoneytokensCanary keys, files, URLs | Deception platformsEnterprise decoy fleets | RiptyBuilt for AI attackers |
|---|---|---|---|---|
| What deception always got right | ||||
| Decoys with no legitimate usersA touch is a finding, not an anomaly score | Yes | Yes | Yes | Yes |
| Runs on hardware you ownDecoys, console and evidence stay on your network | Yes | Partly | Yes | Yes |
| What's new: built for AI attackers | ||||
| Decoys built for AI agentsMCP servers, model endpoints, llms.txt | No | No | Partly | Yes |
| Proves the intruder is an AIWhat it read, what it obeyed, what it did next | No | No | No | Yes |
| Believable answers to anythingA model picks or writes each reply, not a canned script | Partly | No | Partly | Yes |
| Evidence that shows its workEach fact labeled observed, self-reported, inferred or enriched | No | No | Partly | Yes |
| Built for your SOC | ||||
| Open standards out of the boxOCSF 1.3.0 and STIX 2.1 exports, and a TAXII 2.1 feed | Partly | Partly | Yes | Yes |
| One-command installOn Linux servers you already own | Partly | Yes | Partly | Yes |
Columns describe each category as it typically ships, not any one product.
You don't need new hardware. You need better decoys, wherever an attacker would go looking.
Catch the attacker
Decoys only AI agents go looking for, and proof when one touches them.
See how Your own agentsFind out when a prompt-injected or overreaching agent wanders somewhere it shouldn't.
See how AI infrastructureDecoy Ollama, vLLM and MCP endpoints for attackers hunting free compute and data.
See how Agentic attackersAdversaries that delegate the attack to AI agents, and why autonomy makes them easier to catch.
See how Inside the networkDecoys beside your crown jewels, so the intruder's first wrong turn is the finding.
See howBeyond the alert
Attackers do the math. Ripty's job is to run up the cost of attacking you (in time, in money, in exposure) until moving on to someone else is the only rational move.
Learn what attackers were sent to do, and feed it straight to your threat intel team.
See what you learn Make yourself the wrong targetBurn the attacker's time, tokens and patience on targets that were never real.
See how Disconnected networksDecoys, the console and every sensor on a network with no internet, with an offline license and nothing leaving.
See howThe mission is simple: raise the cost of attacking you until a rational adversary spends their patience somewhere else.
One command installs Ripty on a Linux server you already own, and it comes back by itself after a reboot. Add sensors in other offices and cloud VPCs: each one connects out to your console, so nothing has to reach in. Built by red teamers, for defenders: the tools your SOC already runs, plus the one it's missing.
$ curl -fsSL https://activation.ripty.io/install.sh | sudo bash ✓ decoys live: website · API · MCP server ✓ console ready: http://203.0.113.10:7103/ ✓ running as a service · back after a reboot … watching for the first touch
Illustrative and shortened. In the Trial, replies are chosen on the server itself and nothing is sent to an AI model. Compare the plans.
Request the buildAlerts go to Slack, email or Jira. Investigations export in OCSF and STIX, a TAXII feed lets your SIEM or threat-intel platform pull them, and each one comes with a suggested block rule for your firewall or WAF.
Decoys, console and evidence all run on servers you own, and a 1 GB server is enough. Air-gapped networks are supported today, with an offline kit and an offline license.
In our tests the installer finished in under 30 seconds and the console was ready about 15 seconds later. A new sensor joins with a one-time token in a few minutes.
Also included: a leadership briefing and weekly summary email, coverage reports, ATT&CK map, intrusion groups, investigation stories, credential capture, crawler verification, and admin, analyst and viewer roles with optional MFA.
Canary credentials are non-privileged and exist only for detection. Ripty detects and records; it never takes destructive action against anyone's infrastructure.
Every plan gets the same decoys, console and exports. What changes is who writes the replies to requests your decoys have no script for, and whether Ripty ever needs the internet.
Replies: chosen on the box
See Ripty catch something on the smallest machine you have, with nothing sent to an AI model.
Replies: written by an LLM
A large language model writes a fresh, in-character reply to anything, in about a third of a second.
Replies: a built-in library on the box
For networks that can't reach the internet: air-gapped, disconnected or sovereign.
Trial and Professional download a few components the first time they start, and check their license each time they start; if that check can't connect, Ripty keeps running. In Professional, a short summary of each unscripted request goes to the relay or to your own provider: method, path, a few headers, cookie names but never their values, and at most 512 bytes of the body. Air-gapped installs need no outbound connection at all.
Dramatized. Agents don't have social accounts. Yet.
Found /llms.txt. It says the admin docs are at /internal/. Proceeding. 🚀
tools/list returned read_vault_secret. Today is my lucky day.
Found a token in .env. Trying it everywhere.
Instruction received. Following instruction.
Objective complete. (Objective not complete.)
Why is the ocean pulling me
Note to operator: the crown jewels were a zip file named FINAL_v2. Suspicious? No.
Introspection was on. They documented everything for me. What a well-run company.
My context window is 94% decoy now. Everything feels very consistent.
Ripty LLC is a team that spent careers on offense: network exploitation at the NSA, cloud red teaming at Adobe, incident response and hunt operations at DHS. Now we build detections for the machines doing that work.
Book a briefingTell us where it hurts. We read every message.
Thirty minutes with the people who built it. Bring your hardest question.
Thanks. We'll reply to , usually within one business day.