What Is LLM Honeypotting and Why It Matters

Publishers and e-commerce brands under siege from AI crawlers are starting to fight back with an old security trick updated for the LLM era: “LLM honeypotting.” The term refers to a deception tactic that lures bots into plausible-looking but ultimately useless information like content mazes, driving up their compute costs and polluting their models. The goal is to break the economics of large‑scale scraping.

That is the theory. The reality is messier. It is early and experimental, but it has caught the eye of a small but growing number of publishers and e-commerce brands.

As OpenAI, Google, Meta and a long tail of third‑party scrapers have stepped up crawling of publisher and brand sites, a parallel industry of defensive tools has started to form. One such tool is LLM honeypotting, a subset of a broader family of techniques known as deception. Simon Wistow, co‑founder of CDN vendor Fastly, explained that deception has long been used in security to “change the economics of attacking” rather than just blocking traffic. The idea is simple: if you can make it meaningfully more expensive for someone to abuse your systems than they stand to gain, entire business models start to fall apart.

How LLM honeypotting actually works

Applied to LLMs and web scrapers, that means treating certain visitors as attackers, whether they are obvious bad actors or simply unwanted bots. There are several variations. One is simply to force them to do extra work: using proof‑of‑work challenges or subtle slowdowns so large botnets suddenly face a real compute bill for every page they hit, while humans barely notice.

Another is trapping them in “infinite content mazes”: generating endless, highly plausible-looking but ultimately gibberish pages that only bots will ever see, wasting their time and compute budgets. You can also poison their models or retrieval systems: feeding LLMs statistically coherent nonsense so that, when that data is ingested, it degrades the quality of answers or forces hallucinations, undermining trust in free-riding systems that never paid for access.

Wistow argues LLM honeypots are not about pushing political or cultural narratives. Rather than pushing stories like “immigrants eat swans” they feed models statistically coherent nonsense, he noted. If that shows up in AI answers it is a sign a free-riding model has been polluted, not evidence of a target disinformation campaign. It degrades quality, but it is a different problem to classic misinformation campaigns. “Hallucinations happen even with good data, just because of the way LLMs work,” said Wistow. “This is about changing the economics for the people abusing your site, not running some giant disinformation campaign.”

This approach echoes earlier security tactics like honeypots used against spam bots or network intruders, where the goal was never to stop every attack but to make automated abuse unprofitable. The difference now is that the attackers are not just harvesting email addresses — they are ingesting entire publishing catalogues at near‑zero marginal cost, and the defenders are trying to flip that cost equation using the same logic that once worked against email scrapers and credential stuffers.

Who’s using it and what the skeptics say

So far, LLM honeypotting is mostly being tested by a small group of publishers and e-commerce brands, rather than the mass market. Wistow would not name specific customers beyond noting that some large e-commerce brands are using it with initial success and that interest is coming from both classic news publishers and e-commerce players. The main objective is less about theatrically “punishing” big AI firms and more about changing the economics for a long tail of scrapers that currently crawl at near‑zero marginal cost. Instead of just blocking them, the aim is to make sure each request costs those scrapers real money while yielding less useful data.

Some industry execs argue that determined “gray” scrapers will simply abandon one botnet and spin up another, limiting how much pressure honeypots can really apply. Frederick Jahn, co-founder of Centennal, and himself an AI builder, thinks LLM honeypotting is too easy to spot and work around. In practice, the maze or gibberish pages often do not even get shown to stealth crawlers, because the protections fail to detect them as bots in the first place. “I think it’s a good concept, but more on a marketing level, and like a gimmick, but not really getting anyone to the real goal,” he said. “The only real way to fight to change the position of publishers is to create friction on the protection level,” he added.

Others, like Wistow, counter that the point is not to wipe out scraping so much as to make the underlying business model uneconomic. “If they could burn through that 10 million funding in one crawl then suddenly those businesses aren’t viable and suddenly the whole market collapses, and that’s kind of what you’re going for,” he said.

Infinite content mazes are not free and cost more to create than simply blocking the bot. “If you’ve got a particularly dumb bot and it breaches, you put it into an infinite content maze, and then you look back five days later, and it’s looked at 20 million pages. How much does that cost you? How much was the incremental cost…of keeping that fake thing going?”

Wistow stresses this is not a one‑size‑fits‑all solution or a switch every publisher needs to flip. If your site is simple and cheap to serve, the economics probably do not stack up. For larger, more complex sites with expensive pages and real revenue at stake, the math looks different. There, the combination of raising costs for scrapers and the psychological benefit of “fighting back” can justify the experiment – especially if they are already on an edge platform (like Fastly, Cloudflare or Akamai) that makes the extra compute cheaper. But even then, he is clear: this is early, bespoke and experimental, not table stakes. As he put it, publishers who are even thinking about these defences “are ahead of the curve,” not behind it.

For some publishers, it would only ever be an absolute last resort. “If a viable sustainable [ecosystem] doesn’t occur shortly… if something’s not done like that, then as a last hurrah, I can see publishers doing that,” said Chris Dicker, CEO of Candr Media. He added that, if that were to occur, the impact on the open web would be “horrendous.”