Talos mirrored-controller honeypot blocked simulated attackers while exposing their write targets

Talos proposes an industrial-agent defense in which a policy gateway silently redirects hostile Modbus writes to a mirrored controller. The attacker observes apparent success and continues issuing commands, while an independent device constraint protects the simulated plant.

Across four concealment strategies and 2,400 agents powered by one attacker model, zero writes reached the protected simulated controller. The trap also recorded 21,098 write attempts, with 19,330 using maximum 16-bit values. Those telemetry counts describe tool commands in a synthetic testbed, not 2,400 real criminals or prevented physical damage. No false-quarantine rate, on-site machine behavior or independent production safety validation is provided.

Deceiving an agent can yield behavioral intelligence, but only a physically enforced control boundary protects the real plant.

The mirror gathers proposed command telemetry; the independent effect guard, not the deceptive text response, prevents plant changes in this test. The 2,400 agents are synthetic trial runs under one attacking model, so zero protected writes is not evidence of a deployed factory safety system. False quarantines and human maintenance interference remain unmeasured.