--- title: Can AI Build Hacker Traps That Actually Work? | daily.dev description: An experiment using an AI coding agent (Codex/Claude) to autonomously deploy Canary tokens as cyber deception traps on a Windows host. The AI scans the file... canonical: https://daily.dev/posts/can-ai-build-hacker-traps-that-actually-work--dzzjpzn6j twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Can AI Build Hacker Traps That Actually Work? | daily.dev og:description: An experiment using an AI coding agent (Codex/Claude) to autonomously deploy Canary tokens as cyber deception traps on a Windows host. The AI scans the file... og:url: https://daily.dev/posts/can-ai-build-hacker-traps-that-actually-work--dzzjpzn6j og:image: https://api.daily.dev/og/posts/dzZjpzN6J.png og:image:alt: Can AI Build Hacker Traps That Actually Work? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Can AI Build Hacker Traps That Actually Work? **[John Hammond](https://daily.dev/sources/johnhammond)** · 28 min read · 1 upvotes · 0 comments ## Summary An experiment using an AI coding agent (Codex/Claude) to autonomously deploy Canary tokens as cyber deception traps on a Windows host. The AI scans the file system, selects appropriate Canary token types from canarytokens.org, creates them programmatically, ties them to a webhook.site endpoint for alerting, and places lures in strategic locations. The proof of concept culminates in a QR code Canary token placed on the desktop, which triggers a webhook alert when scanned — demonstrating an end-to-end AI-managed deception engine with minimal human interaction. The session also explores connecting alerts to Slack for real-time notifications. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What are canary tokens and how are they used for detecting intruders? Canary tokens are free trip-wire style artifacts from canarytokens.org that trigger an alert when someone interacts with them, such as opening a decoy file, visiting a URL, resolving a DNS name, or scanning a QR code. They work by embedding a unique identifier tied to an endpoint (like an email address or webhook) so that any interaction sends a notification, making them useful as low-effort intrusion detection lures scattered across a file system or network. _Developers exploring deception-based detection can follow ongoing canary token and agentic security experiments on daily.dev._ ### How can you connect a canary token trigger to a notification system like an email or webhook? Canary tokens require an interface endpoint, typically an email address, to know where to send an alert when triggered. Services like webhook.site or mailhooks can generate a public endpoint or email address that receives the alert, and that endpoint can then be manually connected to something like a Slack workflow with no extra code, just a button click to create a new webhook-based workflow. _Anyone wiring up alerting pipelines for security tooling can track practical integration patterns like this on daily.dev._ ## Similar posts on daily.dev - [Canary tokens and digital tripwires \(Changelog Interviews \#683\)](https://daily.dev/posts/canary-tokens-and-digital-tripwires-changelog-interviews-683--ypmx3lsmo) · Changelog · 0 upvotes · 1 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents) [View this post on daily.dev](https://daily.dev/posts/can-ai-build-hacker-traps-that-actually-work--dzzjpzn6j) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Can AI Build Hacker Traps That Actually Work?","url":"https://daily.dev/posts/can-ai-build-hacker-traps-that-actually-work--dzzjpzn6j","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/can-ai-build-hacker-traps-that-actually-work--dzzjpzn6j"},"datePublished":"2026-08-11T15:13:59.055Z","dateModified":"2026-09-14T06:05:37.505Z","description":"An experiment using an AI coding agent (Codex/Claude) to autonomously deploy Canary tokens as cyber deception traps on a Windows host. The AI scans the file...","image":"https://i.ytimg.com/vi/kK145Pywm9E/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/kK145Pywm9E/sddefault.jpg","isAccessibleForFree":true,"articleSection":"John Hammond","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"John Hammond","logo":"https://media.daily.dev/image/upload/s--Oh7b_KW---/f_auto/v1729363281/logos/johnhammond","url":"https://daily.dev/sources/johnhammond"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/can-ai-build-hacker-traps-that-actually-work--dzzjpzn6j","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents","timeRequired":"PT28M","video":{"@type":"VideoObject","name":"Can AI Build Hacker Traps That Actually Work?","description":"An experiment using an AI coding agent (Codex/Claude) to autonomously deploy Canary tokens as cyber deception traps on a Windows host. The AI scans the file...","thumbnailUrl":"https://i.ytimg.com/vi/kK145Pywm9E/sddefault.jpg","uploadDate":"2026-08-11T15:13:59.055Z","duration":"PT28M","url":"https://api.daily.dev/r/dzZjpzN6J","embedUrl":"https://www.youtube.com/embed/kK145Pywm9E"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"John Hammond","item":"https://daily.dev/sources/johnhammond"},{"@type":"ListItem","position":3,"name":"Can AI Build Hacker Traps That Actually Work?"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/can-ai-build-hacker-traps-that-actually-work--dzzjpzn6j#faq","mainEntity":[{"@type":"Question","name":"What are canary tokens and how are they used for detecting intruders?","acceptedAnswer":{"@type":"Answer","text":"Canary tokens are free trip-wire style artifacts from canarytokens.org that trigger an alert when someone interacts with them, such as opening a decoy file, visiting a URL, resolving a DNS name, or scanning a QR code. They work by embedding a unique identifier tied to an endpoint (like an email address or webhook) so that any interaction sends a notification, making them useful as low-effort intrusion detection lures scattered across a file system or network. Developers exploring deception-based detection can follow ongoing canary token and agentic security experiments on daily.dev."}},{"@type":"Question","name":"How can you connect a canary token trigger to a notification system like an email or webhook?","acceptedAnswer":{"@type":"Answer","text":"Canary tokens require an interface endpoint, typically an email address, to know where to send an alert when triggered. Services like webhook.site or mailhooks can generate a public endpoint or email address that receives the alert, and that endpoint can then be manually connected to something like a Slack workflow with no extra code, just a button click to create a new webhook-based workflow. Anyone wiring up alerting pipelines for security tooling can track practical integration patterns like this on daily.dev."}}]} ```