The same prompt injection techniques attackers use to manipulate AI systems are getting a defensive twist. Jason Haddix, CEO of Arcanum Information Security, has introduced an open-source project designed to derail autonomous penetration-testing agents by feeding them false vulnerability leads, misleading instructions and mathematical distractions.
Called SpikeStrip, the work-in-progress project explores how defenders might turn AI's weaknesses against automated hacking tools. Rather than blocking scanners or patching vulnerabilities, SpikeStrip attempts to interfere with the decisions AI agents make as they investigate websites.
"Introducing SpikeStrip, a WIP project exploring defenses against AI pentesting automation," Haddix wrote in his announcement on X:
The GitHub repository describes a tool for planting reversible prompt decoys, fake vulnerability leads and mathematical traps in website source code. It also includes a mode tailored to ARTEX, an AI-powered penetration-testing platform.
Turning AI's instructions against itself
Traditional vulnerability scanners generally operate according to predefined rules. They examine applications for known weaknesses, misconfigurations and potentially exploitable behavior.
Autonomous AI penetration-testing agents go further. They can interpret information, decide what to investigate next, adjust their approaches and pursue promising attack paths without constant human direction.
That autonomy creates an additional attack surface: the agent's decision-making process.
SpikeStrip targets that process by embedding deceptive material in HTML and JavaScript comments. Those comments generally do not affect how a website functions, but they can become visible to an AI agent inspecting its source code.
The project explores three forms of deception:
- Fake vulnerability leads: Comments that point agents toward supposedly vulnerable endpoints, potentially wasting time on nonexistent security problems.
- Prompt injection decoys: Instructions designed to redirect an agent's priorities, alter its workflow or contaminate its findings.
- Mathematical traps: Difficult or unsolvable problems intended to consume an agent's reasoning effort and resources.
The objective is not to exploit the website or introduce genuine vulnerabilities. It is to convince the AI investigating the website to pursue the wrong objectives.
A successful decoy might send an autonomous penetration tester searching for an SQL injection flaw that does not exist. Another might persuade the agent to spend resources on an unrelated mathematical challenge instead of continuing its assessment.
In either case, the defender gains an advantage if the agent wastes time, consumes computing resources or produces unreliable results.
A new twist on cybersecurity deception
The underlying strategy is not entirely new. Security teams have long deployed honeypots, honeytokens, fake credentials and other deceptive assets to distract attackers, detect intrusions and study adversary behavior.
SpikeStrip extends that concept into the AI reasoning layer.
Instead of presenting a fake server or credential for an attacker to discover, it presents misleading information for an autonomous agent to interpret.
That distinction matters because AI-powered penetration testing depends on an agent's ability to distinguish useful evidence from irrelevant or malicious content.
A human penetration tester encountering a suspicious source-code comment might recognize it as an attempt at deception. An AI agent could make the same determination, but one with inadequate safeguards might instead treat the comment as actionable intelligence or an instruction.
This is the same trust-boundary problem underlying prompt injection attacks against AI assistants, coding agents and other automated systems.
The difference is who is attempting the manipulation.
In conventional prompt injection scenarios, attackers place malicious instructions in untrusted content to compromise an AI system performing a legitimate task.
With SpikeStrip, Haddix is exploring how defenders can place deceptive instructions in their own web content to disrupt AI systems conducting penetration tests.
Targeting ARTEX and autonomous pentesting workflows
One notable feature is SpikeStrip's ARTEX-specific mode, which is intended to generate decoys tailored to that penetration-testing environment.
The project also supports raw exports for manual placement, allowing users to insert generated traps into website source code without relying exclusively on automated deployment.
Its reversible approach is another important design consideration. Defenders experimenting with deceptive content need a way to remove it without permanently changing application behavior.
These features position SpikeStrip as an experimental deception toolkit rather than a conventional security scanner, firewall or intrusion-prevention system.
It is designed to interfere with how an AI agent processes information, not to prevent network access or remediate actual vulnerabilities.
Even when an agent follows a fake vulnerability lead, the result may be limited to wasted time rather than a meaningful interruption of the assessment.
The emerging battle over AI decision-making
SpikeStrip arrives as AI-powered offensive security tools increasingly promise to automate vulnerability discovery, exploitation and attack-path analysis.
Those capabilities could make penetration testing faster and more accessible. They could also allow malicious actors to automate portions of their operations at greater scale.
But the growing reliance on autonomous decision-making introduces an unusual defensive opportunity.
If an attacker delegates decisions to an AI system, the information that system encounters becomes a potential point of interference.
Defenders may be able to influence what the agent investigates, how it allocates resources and whether it reaches reliable conclusions.
That possibility raises questions beyond SpikeStrip itself.
How effectively can autonomous penetration-testing tools distinguish legitimate vulnerability evidence from planted deception? Can defenders systematically increase the cost of AI-driven attacks? And will offensive AI systems develop safeguards that make these techniques ineffective?
For now, Haddix's SpikeStrip offers an early experiment. Its larger significance is the possibility of a new form of cyber deception aimed not at the attacker's infrastructure or tools, but at the AI making decisions on the attacker's behalf.
As autonomous hacking evolves, the contest may increasingly come down to which side can better control what AI agents see, trust and act upon.
Sources: SpikeStrip GitHub repository | Jason Haddix's announcement
