Betül Arı Kuvvet

Placeholder session for confirmed speakers without an assigned session, allowing them to be pushed to Swapcard and Visit.

Samaritan is a deterministic honeypot and reverse proxy built for a new defensive problem: autonomous penetration-testing agents that read target-controlled content, reason over it, invoke tools, and produce reports. Conventional scanner detection relies on signatures or request volume. Samaritan instead plants session-specific instructions and promotes a session only when the caller demonstrates comprehension through an observable action.

The session will demonstrate the complete operator workflow. We will deploy Samaritan in standalone decoy mode, compare ordinary scanner traffic with an agent that follows a unique instruction, and watch the monotonic phase ladder advance from unknown through confirmed, engaged, and bitten. We will then show carrier-aware lures in valid HTML, JSON, JavaScript, source maps, SQL, Git, and environment artifacts; measured attrition; report-integrity attacks; causal evidence from native tool records and resolved callbacks; and the authenticated console, campaign report, and kill switch.

Samaritan runs no model in production. Its decisions are deterministic, auditable, and stored as append-only telemetry. Across DarkMoon, Strix, and PentAGI, it measured semantic control, planted findings reaching final reports, and target-derived commands reaching two agents’ own tool environments. The public release stops at reversible host fingerprinting and does not ship reverse-shell, persistence, credential-theft, destructive, or self-propagating payloads.