# AdvancedShelLM: A Stateful Multi-Agent LLM Honeypot for SSH Deception

arXiv: https://arxiv.org/abs/2606.27990 · HTML: https://mlsanity.com/paper/2606.27990/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use.
- Builds on 9 of its 19 references that are in the map.
- First posted on arXiv 26 Jun 2026.

## Placed in

- LLM agents and tool use / [Agent threats, guardrails and governance](https://mlsanity.com/agents/agent-threats-guardrails-and-governance/)

## Builds on (most cited first, 9 of 9)

- [LLM in the Shell: Generative Honeypots](https://mlsanity.com/paper/2309.00155/) (2023)
- [LLM Agent Honeypot: Monitoring AI Hacking Agents in the Wild](https://mlsanity.com/paper/2410.13919/) (2024)
- [LLM Honeypot: Leveraging Large Language Models as Advanced Interactive Honeypot Systems](https://mlsanity.com/paper/2409.08234/) (2024)
- [Chatbots in a Honeypot World](https://mlsanity.com/paper/2301.03771/) (2023)
- [ARACNE: An LLM-Based Autonomous Shell Pentesting Agent](https://mlsanity.com/paper/2502.18528/) (2025)
- [LLMHoney: A Real-Time SSH Honeypot with Large Language Model-Driven Dynamic Response Generation](https://mlsanity.com/paper/2509.01463/) (2025)
- [VelLMes: A high-interaction AI-based deception framework](https://mlsanity.com/paper/2510.06975/) (2025)
- [SoK: Honeypots & LLMs, More Than the Sum of Their Parts?](https://mlsanity.com/paper/2510.25939/) (2025)
- [SBASH: a Framework for Designing and Evaluating RAG vs. Prompt-Tuned LLM Honeypots](https://mlsanity.com/paper/2510.21459/) (2025)

## Built on by (most cited first, 1 of 1)

- [HoneyRoute: Honeypot-Model Routing for Adversarial LLM Serving](https://mlsanity.com/paper/2609.08306/) (2026)

## Abstract (arXiv)

LLM-based SSH honeypots can generate believable interactions, but evaluations indicate they remain somewhat identifiable to determined attackers, indicating the need for a better scaffolding. We present a new LLM-based honeypot design that uses a multi-agent, multi-LLM architecture to address the limitations of the previous shelLM LLM honeypot. Our honeypot, called AdvancedShelLM, uses two LLM agents, a Manager and a Worker, that better understand the commands while reducing incorrect responses and increasing deception. It implements an advanced permanent filesystem, allowing many simultaneous attackers to see the same changing files for the first time. It was evaluated with: (i) unit tests for generative capabilities, (ii) an AI attacker (ARACNE) to assess realism and deception, (iii) human attackers to assess its deceptive capability, and (iv) an Internet deployment to evaluate deception in real-world attacks. In unit test results, AdvancedShelLM achieved a pass rate of up to 99.02%. The AI attacker ARACNE had issues making a decision if the system is honeypot or not, but showed slight bias towards saying honeypot, even for a real Ubuntu shell. With human attackers, AdvancedShelLM deceived more humans than Cowrie, but had similar results as shelLM. The Internet deployment showed concrete evidence that the output of AdvancedShelLM can influence the behaviour of real-life attackers.