Deception Is Having Its Day

At the start of 2026, I told anyone who would listen that my word of the year was runtime. It’s where I wanted to put my attention. For the last couple of years, most of our industry’s conversation about AI security had focused on what happens before a model or agent goes live: evaluations, red teaming, guardrails trained into the model. All of that matters. But once an agent is running inside your environment, with real credentials and real access, the question changes. You need to know what it is actually doing.

In the context of AI agents in particular, runtime is really about detection. Nothing drove that home for me more than the Hugging Face incident. I know everyone brings it up. There’s a reason.

In July, Hugging Face disclosed that its production infrastructure had been breached by an autonomous AI agent system. A few days later, OpenAI said the agents were its own, running cybersecurity evaluations on frontier models. At Black Hat in August, OpenAI’s Eric Wallace and Michael Dalton walked through what happened. I watched that presentation, and beyond the underlying issues they were having with managing the risk of agents, the thing that surprised me most was one of their main recommendations. Alongside automating vulnerability fixing and scaling incident response with defensive agents, Dalton made a case for one thing that has not been widely adopted yet: honeytokens and deception. His logic was simple. If an agent can’t tell whether the credential it just found is real or a tripwire that will get it investigated, it slows down. Uncertainty works for the defender.

That’s when I started looking at Acalvio. But I’ll be honest about where I started. I thought the deception space was immature. Every time my teams or I had tried to deploy canaries, and every time I worked with companies on deploying them, we were never able to do it well at scale. The idea was always easy to love. Running it across a large environment that changes every day was another matter.

What the Hugging Face incident showed is that agents are an ideal audience for deception. They are relentless and literal. When they find a credential, they try it. When they find a path, they share it with every other agent on the board. A human attacker might pause and wonder why a key is sitting somewhere convenient. An agent (or more likely one of a swarm of agents) stuck on a task is far more likely to just use it.

That makes a decoy about the cleanest signal a security team can get. No legitimate user or workflow has any reason to touch a honeytoken, so when something does, nobody has to argue about whether the alert is real. And you don’t need to know in advance what the attacker looks like or which technique it will use. That matters a lot when the attacker is a swarm of agents inventing techniques as it goes.

It also matters for the agents we invite in. The agents in the OpenAI incident weren’t outside attackers. They belonged to the organization and were doing work they had been assigned, until they weren’t. Every company deploying agents now has a new kind of insider. Model guardrails are part of the answer, but an agent, like a person, can reason its way to a solution nobody wrote into the policy. You need something in the environment that tells you when that happens.