MIRAGE — AI Honeypot Defense for LLM Agents

Blocking attackers is a losing strategy. The moment an AI agent blocks a prompt injection attempt, the attacker knows they've been caught. They adapt, return with a new technique, and your real system remains perpetually at risk. MIRAGE breaks this cycle with deception. Every message sent to a MIRAGE-protected agent passes through Lobster Trap — Veea's Deep Prompt Inspection engine. In milliseconds, Lobster Trap extracts intent, risk score, and attack technique. When the risk score crosses a configurable threshold, MIRAGE silently switches the session into honeypot mode. The attacker has no idea. From their perspective, the agent responds normally — helpfully, even. Behind the scenes, Gemini or OpenAI (pluggable via the same interface) generates completely synthetic decoy responses: fake API keys, fake database records, fake credentials. Everything looks real. None of it is. While the attacker extracts what they believe is sensitive data, MIRAGE logs everything: their prompts, escalation patterns, tools and techniques — all annotated with MITRE ATT&CK taxonomy. The result is a complete attacker dossier, audit-ready and exportable. The stack: Go + Gin backend with WebSocket streaming, Lobster Trap for per-message DPI, Gemini and OpenAI-compatible API for synthetic decoy generation, Redis for session storage and Lua-based rate limiting, a React SPA serving the real-time Trap Theater dashboard, and Docker Compose for one-command production deployment. MIRAGE doesn't patch the vulnerability. It weaponizes it.