A honeytoken is bait placed where only an intruder would touch it: a fake customer record in a database, a decoy API key in a configuration file, a dummy tool in an agent’s tool list. Because nothing legitimate ever reads it, an alert on access has almost no false positives.
For AI agents the idea is newly useful. A hijacked agent explores, reads widely and reaches for tools its task does not need, which is exactly the behaviour that trips a decoy. A canary record seeded in customer data can catch an exfiltration attempt before anything leaves, and a decoy tool can reveal prompt injection directly.
The research on decoys for agents is still early, so treat them as one signal among several rather than a complete detection strategy. Their real value is speed: an alert that needs no analyst judgement can be wired to stop the agent automatically.