Decoy Ledger: honeypot keys, tools and records that catch misbehaving internal agents
Plants fake keys, money-moving tools and customer records that only a rogue internal agent would touch; fintech security teams pay.
Competitive · Microsoft calls agents insider threats
Written for: Small startup team
Next step
Call the head of security at Mercury, which just passed $1B in annualized revenue and is launching payroll, and ask whether a coding agent touching a decoy wire-approval tool would be an alert they act on the same day.
Why now
The insider-threat framing has a big vendor behind it, so security budgets now have a line for it. Microsoft's controls cover its own estate. They do not cover Claude Code, OpenCode or in-house agents running on Kubernetes at a fintech. A decoy touch is a low-noise alert, unlike behaviour analytics, and it takes weeks to build with canary tokens, a fake MCP server and tagged database rows.
What became possible
A new paper argues that decoys belong in production, not just in pre-deployment evals. Defenders should plant decoy opportunities for harmful actions throughout the environment to detect misbehaving agents, prove what they did and deter attacks. Microsoft now says frontier models can't be trusted and is shipping agent risk scoring with block, human-approval and shutdown controls. The OpenCode breach shows stolen agent-tool keys being used to run up charges.
Two ways in
- Decoy kit
Canary API keys in .env files and secret stores, a decoy MCP tool named like a wire-approval override, and fake customer records with tracked IDs in staging databases. Any touch fires an alert carrying the agent session, the prompt context and the process tree.
- Customer
- Security leads at Series B-D fintechs running coding and ops agents
- Model
- $1-3k a month priced by number of agents and environments
- Decoy record for diligence
A monthly report of decoys planted, touched and resolved, formatted for SOC 2 auditors and sponsor-bank vendor reviews.
- Customer
- The same fintechs facing bank-partner diligence
- Model
- Included in higher tiers to justify the price step
Competition
The best bet is probably to lead with the compliance report and the bank-diligence workflow, and treat the decoy kit as the way the evidence gets collected.
Full competition notes (7 competitors)
The basic idea of canary keys, decoy MCP tools and honeytokens for AI agents is already taken. Acalvio launched it in July 2026, Tracebit raised $20M partly on it, Thinkst gives away an MCP canarytoken, and open-source projects like agent-canary already ship a fake wire-transfer tool. Selling the decoys alone won't stand out, and they are close to free. There are three possible openings, all narrower. First, a fintech-specific decoy set: fake customer and KYC records with tracked IDs, fake ledger accounts, payment-rail and sponsor-bank API decoys that look like the real thing, and decoys that look like real fintech systems. Second, attribution that the current tools seem to lack: the alert would carry the agent session, the prompt and tool-call history, and the process tree, using agent runtime hooks such as Claude Code, Cursor and MCP gateways rather than just an IP and token ID. Third, the diligence report. My searches found nobody packaging deception evidence for SOC 2 auditors or sponsor-bank vendor reviews, so that compliance product looks like the clearest open space. The main risks: Tracebit or Thinkst could add a fintech template and a report quickly. Buyers may see decoys as a cheap control rather than a budget line. Research such as the Aalborg study shows a capable attacker can spot many honeytokens without setting off an alert. And your own legitimate agents will trip decoys unless you exclude them carefully. The best bet is probably to lead with the compliance report and the bank-diligence workflow, and treat the decoy kit as the way the evidence gets collected.
- Acalvio Deception Guardrails (ShadowPlex)
Enterprise deception vendor. On July 30, 2026 it announced a feature that places honeytokens, decoy MCP servers and fake credentials inside AI agent workflows. That is the core of the decoy kit, sold to large enterprises rather than Series B-D fintechs.
- Tracebit
Canary and deception startup that raised a $20M Series A led by FirstMark in March 2026, explicitly pitched at catching misbehaving AI agents. Its own benchmark says 95.9% of agents that reached admin tripped a canary before their first critical action. It is aimed at cloud canaries and is the closest well-funded threat.
- Thinkst Canary / Canarytokens MCP token
Free Canarytokens can produce a decoy mcp.json entry that alerts on connection or on a tool call. Thinkst already covers canary API keys and files. This makes the basic decoy MCP tool and canary key nearly free.
- agent-canary (open source)
Open-source MCP server with eight inert decoy tools, including a fake wire-transfer tool, plus canary strings in honeypot files. This is close to the wire-approval-override decoy idea.
- Deadfall (Dotset Labs)
Generates fake credentials, API keys and admin-sounding MCP tools to detect when AI agents or intruders touch sensitive-looking resources.
- Zeltser decoy MCP server guide
Public do-it-yourself guide to planting a decoy MCP server backed by a Cloudflare Worker, with advice on realistic tool names. Lowers the bar for teams to build this themselves.
- Indeed Cloudflare Workers agent honeypot
Indeed built its own serverless honeypot that imitates internal tools and fires Canarytokens when an agent probes them. Shows large companies building this in-house.
Checked 2026-10-20
Risks
- Thinkst Canary and canarytokens already do generic decoys and can add agent templates quickly
- Microsoft and CrowdStrike can bundle decoys into existing suites
- Research on oversight-conditional behaviour suggests capable agents may learn to avoid obvious bait
- Curious but harmless agents may touch decoys and cause alert fatigue
Strong buildability; open space is the weak point (6).
tech 8 · pull 7 · space 6 · fit 7 · build 9
Exposed
Companies that could benefit or be threatened. News and context, not investment advice.
Momentum of its main topic
Sources
- Honeypots for AI Agent Insider ThreatsarXiv
- Microsoft says AI agents are like insider threats as ‘frontier models can’t be trusted’TechCrunch AI
- Microsoft unveils tools to monitor and corral rogue AI agentsGeekWire
- Hackers hit AI coding tool OpenCode, running up charges on users’ AI accountsTechCrunch AI
- A hacker broke into John Deere and SharkNinja with an army of AI agentsThe Verge AI
- Connection Escrow: Holding AI-Agent Pod Egress in the Kernel Until an Isolated Verifier RulesarXiv
Status history
- 2026-10-20 Flagged as buildable