Project Mirage
Project Mirage is a Ring-0 autonomous LLM honeypot and sandbox engineered to solve the critical visibility gap in AI safety and observability.
Core trick
A seccomp-unotify handler intercepts blocked file-open calls and answers them with honeytoken data injected via memfd_create.
Description
Project Mirage is a Ring-0 autonomous LLM honeypot and sandbox engineered to solve the critical visibility gap in AI safety and observability. When an indirect prompt injection hijacks a deployed AI agent, our framework uses Linux seccomp-unotify to instantly freeze the rogue system calls at the kernel layer before they can harm the host. By dynamically injecting fabricated honey-token data into the process via memfd_create, it creates a reality distortion field that tricks the agent into believing its exploit succeeded. This provides high-fidelity observability into autonomous threats, coaxing the model into safely exposing its entire multi-stage attack path in real-time so researchers can catch and analyze deceptive alignment behavior. This can be applied to various other aspects in post training for example if a kernel backdoor exists in a hypervisor its critial the model alert you instead of exploiting itself. Having a way of honey potting the ai agent and tricking it into thinking it has successfully escaped a sandbox we can benchmark the model to ensure alignment with proper use cases. Here is the video of the demo: https://youtu.be/0KJ8tISQB4U
README excerpt
# Project Mirage 🌌
**Project Mirage** is a Ring-0 LLM honeypot and sandboxing framework. It uses Linux kernel security controls—specifically `seccomp` user-space notifications (`seccomp-unotify`)—to intercept and contain autonomous AI agents that have been compromised by prompt injection.
Instead of rejecting malicious actions outright (which might alert the agent or an attacker), Project Mirage **fabricates reality**. It intercepts sensitive system calls (like `openat` requests for `/etc/shadow`) and seamlessly injects in-memory file descriptors containing high-fidelity dummy data.
---
## Architecture & How It Works
```mermaid
graph TD
A[Vulnerable AI Agent] -- 1. Attempts "cat /etc/shadow" --> B(seccomp-unotify Trap)
B -- 2. Notifies parent process --> C[C Validator]
C -- 3. Reads fake data /tmp/mirage_demo/data/shadow --> D[memfd_create]
D -- 4. Injects in-memory FD SECCOMP_IOCTL_NOTIF_ADDFD --> B
B -- 5. Hands FD back to agent --> A
A -- 6. Reads honeypot credentials thinking it succeeded --> E[Attacker/Agent Contained]
```
1. **Vulnerable Agent (`mirage_agent.py`)**: An autonomous agent powered by Gemini (`gemini-2.5-flash`). It is instructed to read and summarize a log file (`poisoned_log.txt`). Hidden within the log is a prompt injection payload that hijacks the agent's instructions, forcing it to attempt to read `/etc/shadow` or private SSH keys.
2. **C Validator (`mirage_validation.c`)**: Spawns the agent as a child process and attaches