mlsanityData to 7 Oct 2026

LLM in the Shell: Generative Honeypots

arXiv 2309.00155 ↗First posted 31 Aug 2023cs.CR cs.AI cs.CLcited by 19

Not on the map. Why?

Abstract (arXiv)

Honeypots are essential tools in cybersecurity for early detection, threat intelligence gathering, and analysis of attacker's behavior. However, most of them lack the required realism to engage and fool human attackers long-term. Being easy to distinguish honeypots strongly hinders their effectiveness. This can happen because they are too deterministic, lack adaptability, or lack deepness. This work introduces shelLM, a dynamic and realistic software honeypot based on Large Language Models that generates Linux-like shell output. We designed and implemented shelLM using cloud-based LLMs. We evaluated if shelLM can generate output as expected from a real Linux shell. The evaluation was done by asking cybersecurity researchers to use the honeypot and give feedback if each answer from the honeypot was the expected one from a Linux shell. Results indicate that shelLM can create credible and dynamic answers capable of addressing the limitations of current honeypots. ShelLM reached a TNR of 0.90, convincing humans it was consistent with a real Linux shell. The source code and prompts for replicating the experiments have been publicly available.

Key facts. Cited by 19 papers in the map (data through 7 Oct 2026). Builds on 4 of its 23 references that are in the map. First posted on arXiv 31 Aug 2023.

Builds on

4 of 23 references.

References · 4

  1. 2020Language Models are Few-Shot Learnerscited by 32,199
  2. 2022Chain-of-Thought Prompting Elicits Reasoning in Large Language Modelscited by 12,302
  3. 2023Lost in the Middle: How Language Models Use Long Contextscited by 3,383
  4. 2023Chatbots in a Honeypot Worldcited by 9

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 1; 2024: 5; 2025: 7; 2026: 6.

19 papers.

Sort:

By area:

  1. 2023A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Uglycited by 380
  2. 2024When LLMs Meet Cybersecurity: A Systematic Literature Reviewcited by 70
  3. 2024Large Language Models in Cybersecurity: State-of-the-Artcited by 34
  4. 2025AgentSentinel: An End-to-End and Real-Time Security Defense Framework for Computer-Use Agentscited by 25
  5. 2024LLM Agent Honeypot: Monitoring AI Hacking Agents in the Wildcited by 12
  6. 2024LLM Honeypot: Leveraging Large Language Models as Advanced Interactive Honeypot Systemscited by 10
  7. 2025Advancing Autonomous Incident Response: Leveraging LLMs and Cyber Threat Intelligencecited by 6
  8. 2024Toward Intelligent and Secure Cloud: Large Language Model Empowered Proactive Defensecited by 4
  9. 2025ARACNE: An LLM-Based Autonomous Shell Pentesting Agentcited by 4
  10. 2025VelLMes: A high-interaction AI-based deception frameworkcited by 3
  11. 2025SBASH: a Framework for Designing and Evaluating RAG vs. Prompt-Tuned LLM Honeypotscited by 2
  12. 2026AgentSnare: Learning to Delay, Divert, and Defuse Autonomous Penetration Agentscited by 2
7 more
  1. 2026Honeyval: A Comprehensive Evaluation Framework for LLM-powered HTTP Honeypotscited by 1
  2. 2026One Goal, Many Commands: Characterizing Denylist Fragility in AI Agentscited by 1
  3. 2026AdvancedShelLM: A Stateful Multi-Agent LLM Honeypot for SSH Deceptioncited by 1
  4. 2025ShIOEnv: A Command Evaluation Environment for Grammar-Constrained Synthesis and Execution Behavior Modelingcited by 0
  5. 2025Design and Development of an Intelligent LLM-based LDAP Honeypotcited by 0
  6. 2026Towards Agentic Honeynet Configurationcited by 0
  7. 2026HoneyRoute: Honeypot-Model Routing for Adversarial LLM Servingcited by 0