Research
A honeypot is a computer system that is deliberately exposed and weakly defended, so that the attempts made against it can be recorded and studied. Members of this group have operated such a system since 2024.
Palisade-era AI-safety work that underwrites the monitoring component of the present proposal. Volkov, Serikov, and colleagues continue to carry out relevant work on AI-enabled harm. In an earlier demonstration, Volkov and team showed that current AI systems can autonomously execute harmful end-to-end offensive actions (Bondarenko et al. 2025). In 2024–2025, Volkov and colleagues (Volkov et al. (2025) and Dev, 2025) contributed to a study that made safety-degraded open-weight LLMs and fine-tuned those into being biology lab assistants. Brent and coworkers contributed training materials for that project, and became acquainted with Volkov during the course of that work. In continuing work, Reworr and Volkov (2024a and 2024b) have deployed honeypot infrastructure that has to date captured and analyzed over 1.7 million interactions with weakly defended Linux systems in 10 countries. The system distinguishes AI-agent traffic from conventional bot traffic. This is a working surveillance system for which we maintain codebase and operational experience.
Building on the honeypot work, we are developing license plate readers: methods that detect and characterize artificial intelligence agents when they visit addresses and computational environments, and that assist in recognizing a given agent when it appears again. We intend to establish observatories whose deliberately elicited interactions with agents reveal how those agents respond to unfamiliar obstacles, how they weigh evidence, how they recognize their own errors, and how they decide whether to continue expending effort. We expect that regulated encounters of this kind will disclose retained information, may establish that particular agents are in communication with one another, and may indicate something of the content of that communication.
It has been argued that the near-term governance of agents will require persistent and unique identifiers, so that an individual agent can be recognized over time, connected to a responsible human user, or identified as having no user. In our own terms those identifiers are license plates. Their usefulness would depend on institutional adoption.
Our intention is to set the practice, to show that it works, and to bring the frontier developers to comply with it explicitly. An agent that then lacked an identifier would be conspicuous, and would be easier to detect. We also intend to contribute our observations and our methods to the wider network of researchers now studying agent activity, with particular attention to the scientific software and services that matter for the reduction of risk in biology and chemistry.