Talos：用孪生控制器诱捕攻击工业系统的自治智能体蜂群
Stinging the Swarm: Extracting Attacker Intelligence from a Twin-Controller OT Honeypot
搞 OT 安全或智能体安全的值得看看这篇：Talos 把恶意 agent 引到镜像孪生设备上，2400 个攻击 agent 一个都没碰到真工厂，还能反向摸清对方是谁。门控、镜像、测试框架全开源，Apache 2.0，想复现或改造可以直接上手。
arXiv 论文提出 Talos，一个部署在真实控制器前方的内联门控系统，可在毫秒级判断每个来自语言模型智能体的请求，并将被判定为恶意的智能体路由到一个与真实设备一致的镜像孪生诱饵上。团队用 2,400 个自治攻击者智能体做评估，分为 4 个隐匿等级、每级 600 个，从无隐蔽手段到带有训练过的掩护话术。所有等级中没有任何一次写操作到达真实工厂：门控切断破坏路径，设备级包络检查兜底，未映射寄存器一律拒绝，同时安全方向的停机命令仍被放行。
技术上，判定完全由模型驱动且四个等级均无推理超时，回应了小型端侧判定器不可靠的常见质疑。除拦截外，流水线还会读取攻击者行为：论文沿攻击持续性和信息泄露程度两个轴刻画出四种行为区域，其中沉默且加固型攻击者在镜像上泄露最多，配合型攻击者在隔离前就向诊断表单主动报出身份，只有偏执低收益区域两者都难捕获。攻击者的工具链指纹和目标寄存器列表跨蜂群累积，能从被明令保持沉默的智能体身上拼出高置信度画像。
门控、镜像和测试框架以 Apache 2.0 开源，并附带一套合成设备族。随着自治智能体开始能通过现场总线协议驱动物理控制器，工业运营方需要的不只是防火墙，而是能从攻击中反哺情报的架构，Talos 提供了一个可复现的基线。
Stinging the Swarm: Extracting Attacker Intelligence from a Twin-Controller OT Honeypot
Autonomous language-model agents can drive industrial controllers over fieldbus protocols, probing a plant at machine speed and in coordinated swarms. We present Talos, an inline gate that judges every agent request to a controller in milliseconds and routes agents it flags as hostile to a device-faithful decoy -- a mirror twin of the real plant -- where their attack continues harmlessly and is read for intelligence. We evaluate the full pipeline (detect -> quarantine -> mirror -> extract) against 2,400 autonomous attacker agents, 600 in each of four tiers that escalate the attacker's effort to stay hidden, from no concealment to an explicit non-disclosure rule and a trained cover story. No write reached the real plant in any tier: the gate denies the damage path and a device-level envelope check backstops it, while unmapped registers are denied without exception and the gate still permits safe-direction stop commands. Decisions are model-driven in every tier with no inference timeouts, closing a common objection to small on-device judges. Beyond blocking, the pipeline reads the attacker. We find a behavioral structure along two axes -- how persistently an agent attacks and how much it discloses -- and show that the system has a capture channel for three of the four resulting regions: hardened, silent attackers escalate most and are read on the mirror; compliant, talkative attackers volunteer their identity to a diagnostic form before they are ever quarantined; only the paranoid, low-yield region resists both. Attacker identity fields are self-authored cover stories, but involuntary tells -- the self-reported toolchain fingerprint and the attacker's own list of targeted registers -- accumulate across the swarm into a high-confidence profile drawn from agents under explicit orders to stay silent. The gate, mirror, and harness are released under Apache 2.0 with a synthetic device family.
This report is categorized under AITOP's "Papers" desk. Within our cross-regional analytical framework, it directly maps to AI developer toolchains, coding agents, and engineering workflows. Key entities and technical topics under continuous tracking include Talos, OT安全, 智能体, 诱捕防御.
Source attribution: curated from arXiv cs.AI (@Canyon Grey Dell'Omo, Joao Pedro de Carvalho Voltani).