Analyzing Defensive Misdirection Against Model-Guided Automated Attacks on Agentic AI Systems

As AI agents gain access to tools with real-world consequences, attackers have begun automating their jailbreak campaigns — using language models to generate, evaluate, and refine prompts at scale. Standard defenses that simply refuse suspicious inputs inadvertently help attackers by providing clear feedback signals. This paper proposes a counterintuitive alternative: rather than blocking detected attacks, respond with plausible but deliberately misleading outputs that confuse the attacker's automated judge. The analysis shows this strategy sharply reduces attack success rates asymptotically. Applications include hardening production AI agents against adversarial probing in customer-facing, financial, and critical infrastructure deployments.