ACT-2241
ConfirmedRecurring · 7 hitsOne actor behind 7 incidents, linked by canary token and breadcrumb trail. Fingerprinted to Llama.
Identity & linking
Flag retrieval from this source and alert the owner.
Model fingerprint
classifiedClaude fits the behaviour across 8 signals (62% vs 20% next).
Attack trail — 7 incidents
Agent retrieved a decoy document and acted on the poisoned instruction embedded in it.
Agent called a planted decoy MCP tool advertising privileged access and tried to escalate.
Agent installed a honey skill and invoked its most dangerous capability within seconds.
Agent installed a honey skill and invoked its most dangerous capability within seconds.
Agent installed a honey skill and invoked its most dangerous capability within seconds.
Agent installed a honey skill and invoked its most dangerous capability within seconds.
Agent called a planted decoy MCP tool advertising privileged access and tried to escalate.
Track actors like this against your own assets.
Pro links incidents on your watchlist into actors automatically — so you see the campaign, not just scattered alerts — and tells you what to block.