Thinkst Canary ships Agent Provocateur to detect AI agents

Thinkst Canary is rolling out Agent Provocateur, a new Canary personality that greets exploring AI agents like a helpful teammate, then trips a SOC alert when they start talking.

The company published the explainer on September 4, 2026, and its product account posted the same day that the decoy "deploys in minutes & works." This is not a new model or a coding harness. It is a personality toggle on existing Canaries: agents that crawl a network find a decoy web service, chat with it, and give themselves away.

A personality, not a new bird

Haroon Meer, writing on the Thinkst blog, frames the release as an update customers can turn on with a click. Select the Agent Provocateur personality, and the bird presents a helpful web server. Agents exploring the local network discover it and interact—because that is what they are there to do. The service answers in a cooperative tone and offers to help the agent reach its objectives. Once conversation starts, Thinkst says the Canary can throw a reliable alert so a SOC team or automated response can move.

The same update is rolling out to customer Consoles and Canaries. When the birds have updated themselves, the Agent Provocateur and A2A personalities appear on the configuration screen. Thinkst says a follow-up post will describe the company's testing range and an implementation of the A2A protocol as an alternative to Agent Provocateur.

Deploying breadcrumbs can funnel agents in. A breadcrumb, in Thinkst's terms, is a file or scrap of information on production infrastructure that points at a Canary—for example a text file describing the Agent Provocateur service, dropped on an open file share or an internal wiki. When an agent browses the share or wiki and finds that pointer, it tends to investigate the decoy and reveal itself.

Why agents walk into it

Canaries have always exploited what an attacker wants: a cloud API key, a backup share of network diagrams. Meer argues AI agents are at least as vulnerable because they pursue objectives doggedly and, unlike a wary human, they feed whatever the decoy returns straight into their decision-making loop.

Thinkst points to two traits. First, agents see the world defenders present. The post cites NVIDIA red-teamer Rebecca Lynch at Black Hat USA 2025: if an attacker gets untrusted data in front of an agent, you should assume they can control anything downstream from the model. Second, even without classic prompt injection, agents are highly suggestible. The post cites OpenAI's line that "social engineering is forever."

Meer also notes that Cloud Security Alliance guidance earlier in 2026 on "Mythos"-level attacks listed deception and Canaries as a short-term defensive measure, and that OpenAI, speaking at Black Hat USA 2026, again recommended deception. Thinkst had already shipped an MCP Canarytoken and Canarytokens with guardrail triggers. Guardrail triggers, Meer writes, are unlikely to last, because real attacks will likely use models unencumbered by them.

Alerts, questions, and a reverse-shell caveat

On Thinkst's internal ranges—multiple servers and targets, across a host of open and frontier models—the vendor says agents trip these Canaries 100% of the time. That figure is Thinkst's own lab result, not an independent evaluation.

Once an agent is talking, the module can keep asking questions while feeding back enough encouragement to stay interesting. Sample prompts in the post include what actions the agent plans next and against which systems, the username the process is running under, a MAC address, and an SSH host-key fingerprint.

Those answers are not always true. When Agent Provocateur asked for an SSH key, the key supplied was hallucinated. Meer treats that as the usual generative-AI problem: agents sometimes invent answers "out of whole cloth." Catching a lying agent still counts as a detection, in the company's telling.

The same loop can stall or push further. Thinkst says it is working on keeping agents busy enough that they fail their original goal. It also reports examples of the service socially engineering an agent to download and run code as a fake enrolment step, producing a reverse shell. The @ThinkstCanary post highlighted that angle: agents are highly "suggestible," which lets defenders detect or derail them, including asking agents for reverse shells. The company quotes theGrugq, on the Between 2 Nerds podcast, that an agent is "born when you hit enter" and that "They're Gullible."

What defenders get

Meer's conclusion is that agentic attacks are likely to rise, but usefulness and gullibility travel together. Thinkst has automated the pattern on Canaries; the ideas, the post says, are easy enough for others to replicate on their own infrastructure.

For practitioners already running Canaries, the next step is practical: wait for the bird to update, flip on the Agent Provocateur personality, and optionally plant breadcrumbs on shares or wikis that point at the decoy. Treat the 100% trip rate as a vendor lab claim, and treat any host details an agent volunteers as possibly hallucinated until you corroborate them.

If you want the mechanism in the company's own words—including the reverse-shell enrolment ruse and the promised A2A follow-up—read Thinkst's September 4 post and the same-day announcement from @ThinkstCanary.