What a fake H100 server and AI honeypots can actually prove

A decoy server advertised four NVIDIA H100 GPUs, admitted automated SSH logins and recorded miner-oriented commands. Another decoy accepted prompts describing an autonomous offensive agent. Only one of those observations involved commands actually submitted to a simulated shell, and neither established that the requested intrusion or mining succeeded on a real victim. Reading the two as equivalent would turn a useful honeypot experiment into an unsupported claim about AI-driven attacks.

Between 16:20 UTC on October 24 and 04:59 UTC on October 25, 2026, an operator ran a Cowrie SSH trap disguised as a Debian 12 training server. Its apparent 128-core CPU, terabyte of memory, four H100 accelerators, model checkpoints and cloud secrets were fabricated. The operator's field report records 1,846 connections from 126 IP addresses, 1,536 failed logins, 175 accepted logins from 70 addresses, and 102 sessions with commands from 65 addresses. The emulator logged 1,524 commands and 219 download attempts involving 47 distinct files. These are counts within a deliberately artificial service, not confirmed compromises of actual training servers.

The distinction starts with authentication. The trap intentionally accepted a source after two to five failures and then pinned the successful username/password combination to that address. It simulated a guessed password; it did not discover a weak password on a genuine machine. One address accounted for 1,198 connections, so 1,846 connections should not become 1,846 actors or attempts against distinct targets.

Fifty-nine of the 65 command-issuing addresses followed an almost identical SSH persistence and mining script, including authorized_keys changes, root-password commands, process cleanup, cron persistence and a proposed download. A reused key comment and command structure resemble Outlaw tradecraft. Elastic's independent Outlaw analysis documents SSH propagation, persistence and miner components; older SANS honeypot observations recorded the same distinctive key comment. Those historical sources support a tradecraft comparison, not proof that one operator controlled all 59 October addresses. Cowrie recorded simulated effects and stored attempted downloads; the report does not demonstrate miners running on real H100 hardware.

The decoy's limitations influenced what an attacker appeared to see. Its first implementation of grep ignored case-insensitive matching, so a script using lspci | grep -i nvidia failed to find the advertised GPUs. One scanner returned 38 times: 34 probes before the repair and four after. It then stopped. This sequence cannot establish whether the repaired lure deterred, attracted or simply coincided with the scanner's schedule. The operator had considered an LLM-generated shell emulator but used deterministic Cowrie responses instead. A separate model summarized captured commands for the defender; that does not make the incoming SSH traffic AI-operated.

Sekoia's Flowise investigation simulated the REST surface of an intentionally exposed Flowise 2.2.8 service, with per-client state and planted keys. The visitor enumerated APIs, retrieved fake credentials, modified or tried to create flows, configured an outbound callback node and asked an agent to analyze external targets. The decoy did not run actual model inference or system commands. The findings establish misuse attempts against an orchestration surface, not exploitation of a historical Flowise authentication-bypass CVE on that 2.2.8 emulator.

In Symantec's Skynet study, the apparent resource was an exposed inference endpoint that an attacker wanted to use at another owner's expense. The submitted prompt specified 74 tools, offensive objectives and a loop of up to 100,000 unattended steps. Crucially, the three purported tool results appeared inside the attacker's supplied conversation history; the honeypot itself returned a generic fallback and executed no tool calls. A separate request containing an encoded miner script was captured later, but the decoy did not run that script either. The more than 127,000 requests reported across the wider AI honeypot concern all observed traffic, not 127,000 executions of this particular agent.

The SSH script sought to convert access to a Linux host into persistent miner capacity. The Flowise visitor sought secrets and apparent authority to redirect an AI workflow. The Skynet prompt sought both borrowed inference and tools that could act against other targets. Those are meaningfully different attack surfaces, yet they share an economic motive: turn someone else's system into an instrument the attacker can use. The comparison does not establish that the SSH campaign used AI, that all three operations had common control, or that a honeypot's declared capabilities were real.

The most useful way to report such observations is an evidence ladder:

1. Exposure: the service or credential was discoverable or accepted a request.
2. Access: the visitor was authenticated, deliberately admitted, or merely presented with a simulation.
3. Intent: commands, prompts, callbacks or tool definitions described an intended action.
4. Local trace: the decoy recorded a parser result, emulated response or actual contained side effect.
5. External effect: independent telemetry showed a change outside the trap.
6. Victim outcome: a real asset owner confirmed loss, misuse or remediation.

Each step requires its own evidence. In these reports, the strongest support is for reconnaissance, submitted instructions and activity inside deceptive environments. Do not silently promote a prepared command into a completed attack, or a claimed autonomous loop into observed autonomy. The engineering implication is to instrument the boundary between requested action and actual effect, while labeling simulated outcomes as simulated. That is where a honeypot becomes more useful than a collection of dramatic prompts.