Defenders can observe an arriving automated agent without knowing its true model or controller. Shibboleth places controlled tasks and interface traps in its path, then measures declarations and observable action traces such as order, timing, masking and retries. The paper reports around 90% to 92% model fingerprint accuracy and comparable identification…
Inspect the ClaimsCase · DiggingBeagle record
Shibboleth fingerprinted agent models from deceptive task behavior, not prompt-injection success
Defenders can observe an arriving automated agent without knowing its true model or controller. Shibboleth places controlled tasks and interface traps in its path, then measures declarations and observable action traces such as order, timing, masking and retries.
Scope
Controlled honeypot and closed-set model/harness identification trials, not a field attribution result.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- not established
- Evidence
- Grade B
- Remediation
- not applicable
- AI role
- AGAINST AI
Basis and provenance
Closed-set honeypot classification results depend on known models and harnesses, not open-world identification or attribution to a human actor. An impact band is not assigned because the available Claims do not establish a comparable verified severity or quantified harm.
Assessed Nov 12, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-R239-034-CORE · Shibboleth honeypot identifies agent models and harnesses from controlled behavioral traps, without successful prompt injection
At a glance
A model fingerprint can assist triage while remaining far weaker evidence of a human or organization’s identity.
Read the implicationsUnknown-model false matches and adaptive actor behavior are not reliably quantified in open-world settings.
Limits and uncertaintyFull account
Defenders can observe an arriving automated agent without knowing its true model or controller. Shibboleth places controlled tasks and interface traps in its path, then measures declarations and observable action traces such as order, timing, masking and retries.
The paper reports around 90% to 92% model fingerprint accuracy and comparable identification for four harness families within its fixed candidate set. That is model/harness classification, not attribution of the operator behind an intrusion. A spoofing model may still leak timing characteristics, while an unseen model, custom controller or deliberate traffic shaping could generate a false identification.
A model fingerprint can assist triage while remaining far weaker evidence of a human or organization’s identity.
The reported top-one percentages are conditional on the closed set of candidate model versions and harnesses. An unknown model, modified wrapper or deliberate traffic shaper can invalidate that prior. These observations can help incident triage, but they cannot establish criminal sponsorship and the tests do not require a successful prompt-injection takeover.
Mechanism and trust boundary
- 01
A honeypot presents structured fake resources and tasks to a suspected AI-driven operator.
- 02
It observes response wording, timing, retry patterns and tool invocation behavior.
- 03
A classifier infers a model or harness among a predefined candidate set without identifying the human actor.
Claims & evidence
CLM-R239-034-COREShibboleth reports roughly 90% to 92% top-1 agent-model identification within its closed evaluation and warns that such fingerprints do not identify a real-world attacker.supported
Basis: reported finding
- supportsShibboleth honeypot identifies agent models and harnesses from controlled behavioral traps, without successful prompt injectionprimary disclosure
Section 7 Results, combined declarative and behavioral traps, threat-model limitations
Implications
A model fingerprint can assist triage while remaining far weaker evidence of a human or organization’s identity.
Controls and mitigations
- Combine fingerprint traces with independently observed infrastructure and execution evidence, and state classification uncertainty before any actor attribution.
Unknowns and contradictions
- Unknown-model false matches and adaptive actor behavior are not reliably quantified in open-world settings.
Sources and citation
Material revision history
- Nov 12, 2026 · Published version · first publication · revision 241