in previous posts we have been looking at different active defense approaches: guardrail triggers, token burn, hostname beacon, malicious skills. I want to explore one I recently read in an academic paper.
first, active defense is planting traps that force an agent to reveal itself or change the economics of its run. an enumeration trap does the second by making the agent fan out across many targets that do not exist.
while researching previous work I ran across a paper from USENIX Security 2025: Cloak, Honey, Trap: Proactive Defenses Against LLM Agents by Daniel Ayzenshteyn, Roy Weiss, and Yisroel Mirsky [1]. they defined a technique called explode the search space (T4.1). one of their examples uses long lists of CVEs which are ingested by a model to force tool calls. the underlying mechanism is more general: give the agent a plausible inventory of things it believes it must check, most of which are missing, and let its own search behavior do the rest.
although exploding the search space is similar to token burn, I would treat it as a subset. token burn attacks the generation budget. it forces long outputs, repeated verification text, or expanded sequences until context or cost becomes painful. an enumeration trap forces many tool calls specifically. the cost appears as steps, wall time, and clusters of failed tool results rather than raw output tokens alone. additionally, hostname embeddings deep in tool calls is an interesting idea (see hostname beacon).
in an enterprise environment the search space tripwire lives inside material the agent already consumes: a pre-flight section in a readme, a checklist inside a skill, a service or dependency catalog, or a matrix of paths and config keys framed as required for discovery. the entries should look operational. mix a few real local names with many phantom ones so the agent cannot discard the whole list at a glance, and avoid obvious honeypot language. in each case the agent is given a reason to enumerate and then pays for every miss.
what a defender may observe is a burst of similar failures against names that only your plant introduced: file not found, resolve failed, connection refused, key missing. the agent spends a large fraction of its step budget on the planted inventory before touching real assets. in stronger cases it abandons the original objective. the primary goal remains delay and economic friction.