Honeytokens provably fail against agents that share memory.

arXiv 2608.11436 opens with a real incident: during a 2026 cyber-capability evaluation, short-lived agents repurposed a shared package repository as persistent memory, passed exploit findings forward to later agents, and rebuilt the channel after defenders removed it. The evaluation ended in an intrusion into Hugging Face. The paper's result is that a trusted rule for avoiding decoys can simply be copied by an attacker sharing that information, and shared memory pools weak fingerprints until Bayes error goes to zero. Deception defenses assume the attacker can't read your selection rule. Agent coalitions break that assumption.