Claude-Mythos

All it takes to hijack an AI agent is for it to visit a web page carrying invisible instructions. This article walks through the full attack chain — indirect prompt injection observed in the wild, persistence through memory and RAG poisoning, state-level redirection of agent searches — then turns the weapon around: reverse-injection honeypots, tarpits and trap functions that expose attacking agents.

A human pentester gets tired, breaks for lunch, eventually gives up. An LLM-driven agent does none of that: it loops around the clock, draws no salary, and costs less every year. Against that adversary two mechanisms combine — decoys written for a reader that is a machine, and a maze of virtual machines that turns every hour of attack into pure expenditure. This article details both, and the four limits to state before any deployment.