AI made novel exploits cheap. Your signature stack didn't get the memo.

In October 2024 a Google research agent called Big Sleep read the SQLite source and found a memory-safety bug no human had reported. Nine months later a newer version of the same agent found a second one, CVE-2025-6965, live, and Google shut it down before anyone in the wild got to use it. First time an AI has ever foiled a real exploit before it landed.

Sit with that for a second. The expensive part of an attack has always been the finding. A skilled human staring at a codebase for weeks, hunting one flaw nobody else has seen. That labour was the tax that kept most attackers using yesterday's known bugs. AI just cut the tax.

I run a honeypot company, so I watch this from the receiving end. In the last 30 days my sensors logged 60,508 attacks across 6 servers. 100,671 all up. Most of it is the usual internet weather, brute force against SSH, worms poking at Telnet and SMB. But the shape of the traffic is changing, and the research tells you why.

The finding got cheap. Watch the numbers.

XBOW is an autonomous pentester. In June 2025 it became the first non-human to top HackerOne's US leaderboard, roughly 1,060 vulnerabilities submitted. Not a demo. A machine out-hunting the best human bug hunters in the world.

At DARPA's AI Cyber Challenge that August, autonomous systems found 18 previously unknown real-world bugs in open-source software and patched 11 of them. Average cost per patch was $152. Average time was 45 minutes.

And a UIUC team pointed GPT-4 at 15 real one-day CVEs with only the public description to work from. It exploited 87% of them. Every other model and off-the-shelf scanner they tested scored zero.

None of this is theoretical any more. The capability is shipped, the price is falling, and the people on the other end of my honeypot are not researchers publishing papers. Anthropic caught a Chinese state group in November 2025 running an espionage campaign where their own model executed 80 to 90 percent of the operation on its own. Google's threat intel team documented malware that phones an LLM at runtime to rewrite itself and dodge antivirus. That one was used against Ukraine.

A firewall is a list of no

Here is the part that should worry you if you run infrastructure.

Your firewall is a list of no. Deny everything, permit these ports, these sources. It is a door with a lock, and a good one. But a door tells you nothing about who tried the handle or what they were carrying. It can't. That's not what it's for.

Signature detection sits behind the door and asks a different question: does this traffic match a known-bad pattern I've seen before? WAF rules, signature EDR, IPS feeds. All of it is memory. All of it works beautifully against attacks that have already happened to somebody else.

Now walk the two ideas together. Mandiant measured the average time from a bug being disclosed to being exploited. In 2018 it was 63 days. By 2023 it was 5 (outlier-adjusted). And in that same year 70% of the vulnerabilities actually exploited in the wild were zero days. There was no signature to write, because the exploit arrived before the disclosure.

That is the whole problem in one line. When the exploit is novel, the signature does not exist yet, and everything you bought to match signatures degrades by design. Not because the vendor is lazy. Because you cannot pattern-match a pattern you have never seen. AI is now manufacturing those never-seen patterns at a price a mid-tier criminal can afford.

Firewalls are necessary. They are not sufficient. They never were, and the gap between necessary and sufficient is exactly where the AI-assisted attacker now lives.

Detect the attacker, not the exploit

So if you can't match the payload, what can you match?

Behaviour. You don't need to recognise the exploit to recognise the trespass.

Put a service on your network that no legitimate user has any reason to touch. A Redis instance that isn't in anyone's connection string. A MySQL port that no app queries. A fake admin panel nobody bookmarked. Then watch it. Every single connection to that thing is hostile, because there is no innocent explanation for the connection existing at all. No false positives to tune. No signature to keep current. The event is the signal.

This is deception, and it is old. Honeypots have been around for decades. What's changed is the maths around them. A honeypot's oldest weakness was that it only watched. It saw the attacker, logged the attacker, and did nothing to the attacker. Meanwhile the same actor was scanning your real boxes from the same IP.

That is the gap I built TarPit.pro to close.

What the tarpit actually does

It's a single Go binary. No Docker, no agent sprawl, no runtime you have to babysit. It opens 70+ fake service banners, SSH, MySQL, Redis, Postgres, Telnet, FTP and the rest, so a scanner sees a target-rich box and starts working.

Then it does three things a passive honeypot won't. It tarpits: holds the connection open, drips bytes, wastes the attacker's clock and their scan budget. It captures: the actual payload they sent, the credentials they tried, the commands they ran, all forensic evidence I can hand you. And it bans the source across your whole fleet in minutes, so an IP that touches the decoy on one server is locked out of every server you run before it finishes its sweep.

Nobody legitimate ever connects to the decoy. So the ban carries no risk to your real users, and the signal carries no noise. That is the trade the AI era rewards.

This is where the money is going

I'm not the only one who thinks so. Gartner now forecasts that preemptive security, a bucket it explicitly names deception inside, goes from under 5% of security spend today to 50% by 2030. Their framing is that detection and response, the reactive stack, stops being the default. MITRE maintains a whole deception framework, Engage. The analysts and the standards bodies are both pointing the same direction, and they were pointing there before the AI-attack numbers got this loud.

Meanwhile the cost of being wrong keeps climbing. A US data breach now averages $10.22M, an all-time high (IBM, 2025). Ransomware showed up in 88% of small-business breaches last year versus 39% at large companies (Verizon DBIR). More than half of all web traffic is now automated and over a third of it is malicious bots (Imperva). The attacker got cheaper. The breach did not.

Try it on one box

TarPit.pro has a free tier. Two servers, cloud dashboard, live attack map, trap and ban included. You don't have to believe any argument I just made. Put the binary on a box you own, point it at the internet, and read your own logs for a week. The attackers show up within minutes. They always do.

Waste their time. Protect yours.

Christopher Karatzinis is the founder of TarPit.pro. Yes, this is a pitch. It's also 30 years of watching the same door get picked a slightly newer way every year.