Paper

HoneyGPT: Breaking the Trilemma in Terminal Honeypots with Large Language Model

Presents a language-model terminal honeypot architecture and describes a field evaluation.

HoneypotNetwork

Evidence limits

Metrics favor response coverage; they do not prove credibility against human adversaries or sustained cost.

Reviewed: Full text.

Full-text review · 2026-09-16

Design and scope

LLM terminal architecture evaluated with response, session-length and interaction metrics.

Main finding

In the reported tests, GPT variants respond to more commands and sessions than Cowrie.

Evidence limits

Metrics favor response coverage; they do not prove credibility against human adversaries or sustained cost.

Sources and provenance

  1. HoneyGPT: Breaking the Trilemma in Terminal Honeypots with Large Language Model
    Full text · 2026-09-16

Reviewed: 2026-09-16. This record may change when new evidence is found.

RIS · BibTeX

Related resources

Open software—

Cowrie

Material reviewed: Repository metadataCritical reading

SSH and Telnet honeypot that records login attempts and attacker sessions.

NetworkHoneypot
Open software—

Galah

Material reviewed: Repository metadataCritical reading

Web honeypot using a language model to generate interactions.

ApplicationHoneypot