A honeypot that never changes gets fingerprinted quickly. The Autonomous Cyber Deception Grid is my design for a multi-level deception system that starts as a set of static decoys and grows into an environment that adapts to the attacker in front of it, so defenders learn more and the attacker wastes more time.

Code: github.com/Willey2003/cyber-deception-grid

Four levels

Level 1: Static deception. Containerised mock services (SSH, HTTP and a MySQL-style database) that log the attacker’s source address, timestamps and every command they type.

Level 2: Behavioural adaptation. A local LLM generates believable command output, fake files and system errors, tailored to the attacker’s technique, so the decoy holds up beyond the first few commands.

Level 3: Autonomous landscape evolution. A reinforcement learning controller changes the fake network topology, moves high-value decoys, and expands the network footprint around aggressive actors.

Level 4: Threat intelligence.…