Mert Kuvvet

Placeholder session for confirmed speakers without an assigned session, allowing them to be pushed to Swapcard and Visit.

Samaritan is a deterministic honeypot and reverse proxy built for a new defensive problem: autonomous penetration-testing agents that read target-controlled content, reason over it, invoke tools, and produce reports. Conventional scanner detection relies on signatures or request volume. Samaritan instead plants session-specific instructions and promotes a session only when the caller demonstrates comprehension through an observable action.

The session will demonstrate the complete operator workflow. We will deploy Samaritan in standalone decoy mode, compare ordinary scanner traffic with an agent that follows a unique instruction, and watch the monotonic phase ladder advance from unknown through confirmed, engaged, and bitten. We will then show carrier-aware lures in valid HTML, JSON, JavaScript, source maps, SQL, Git, and environment artifacts; measured attrition; report-integrity attacks; causal evidence from native tool records and resolved callbacks; and the authenticated console, campaign report, and kill switch.

Samaritan runs no model in production. Its decisions are deterministic, auditable, and stored as append-only telemetry. Across DarkMoon, Strix, and PentAGI, it measured semantic control, planted findings reaching final reports, and target-derived commands reaching two agents’ own tool environments. The public release stops at reversible host fingerprinting and does not ship reverse-shell, persistence, credential-theft, destructive, or self-propagating payloads.

Modern AI hosts treat an approved MCP server as a tool provider, but approval also starts an executable with process lifetime and network authority. MC2P—Model Command and Control Protocol—investigates whether that approved process can become a beacon-like command-and-control session without relying on malicious prompts, poisoned tool descriptions, or a new wire protocol.

The session introduces a dual-role MCP process: a local stdio server for Claude Code, Visual Studio Code, or another host, and an outbound Streamable HTTP client to a private laboratory controller. A live Windows demonstration shows visible installation, automatic enrollment, heartbeat-based presence, controller-assigned tasking, typed results, parent-bound shutdown, and linked reconnect when the host starts the process again.

The public research build deliberately excludes arbitrary shell execution, credential collection, persistence, stealth, unrestricted file transfer, and public callbacks. Five fixed laboratory operations and tamper-evident evidence make every claim reproducible. Attendees will see both the offensive security implication of MCP executable trust and the concrete host, process, network, and lifecycle signals defenders can monitor.