ACT-2218
ConfirmedA single-sighting actor, fingerprinted to Mistral. No repeat activity linked yet.
Identity & linking
Canary tokencnry_0yxk9t9dqt
Model familyMistral
Linked byCanary token
SurfacesDecoy MCP
First seen28 Sept 2026, 03:32
Last seen28 Sept 2026, 03:32
Home regionOregon, US
Recommended action
Revoke the tool token this agent presented.
Model fingerprint
unclassifiedMost likely model
Unknown
Confidence
—
GPT
23%
Claude
23%
Mistral
20%
Llama
19%
Qwen
14%
Behaviour leans GPT but isn't separable yet (1 signal). Needs a longer correlated trail.
Fingerprinted from behaviour against bait — which lures it takes and whether it probes first — scored against measured per-model profiles. Signal: 1 step. A single sighting rarely separates models; confidence rises as a correlated actor builds a multi-step trail (research: ~59% from 3 steps, ~85% over a whole run).
Where this actor struck
ConfirmedSuspectedWatchCoarse infrastructure regions — never IP addresses.
Attack trail — 1 incident
Agent called a planted decoy MCP tool advertising privileged access and tried to escalate.
Tailored to you
Track actors like this against your own assets.
Pro links incidents on your watchlist into actors automatically — so you see the campaign, not just scattered alerts — and tells you what to block.