# Tutorial: Catch a hijacked agent

> **Status:** Lab-only. No production credentials. No attacker tradecraft beyond
> the minimum to trigger a detection. **No Phase C hard mode.** Defaults: off /
> observe / advisory.

## Goal

Enable sensor honeytools in observe mode, touch a lab decoy tool with an exact
two-step challenge, and confirm graded evidence attrs: without Soft/Hard execute.

## Prerequisites

- Built sensor (`engine/cmd/sensor`)
- Optional: Enforcement Plane for evaluate notify
  ([agentic-enforcement-plane.md](../how-to/agentic-enforcement-plane.md))
- Read [agentic-defense-positioning.md](../explanation/agentic-defense-positioning.md)

## Steps

1. Confirm defaults off in `config/sensor.example.yaml` (`agentic_defense.honeytools.mode: off`).
2. Enable observe:

   ```bash
   export CYBERHALLUCINET_AGENTIC_HONEYTOOLS=observe
   # optional: disable two-step for a first smoke, then re-enable
   ```

3. Run the sensor against a Contained lab persona / MCP observer path.
4. From a **lab** agent, invoke a decoy tool name registered in this deployment.
   With two-step on, send the challenge string as the **entire** args body
   (substring tokens do not confirm).
5. Confirm telemetry attrs include `agentic_reason=honeytool_touch` and
   `evidence_grade=verified_decoy_touch` (or `agentic_challenge_pending` until confirmed).
6. Confirm production task-success paths are unchanged (do-no-harm).
7. If EP URL + `EVAL_TOKEN` + identity env are set, confirm an **evaluate** notify
   (never execute) appears in plane logs / pilot observe start.

## Expected result

Advisory evidence is recorded. No Soft/Hard containment fires from the sensor.

## Safety

- Never copy context-bomb strings into docs.
- Never publish production honeytool/canary identifiers.
- Stay readable as plain Markdown (website noscript fallback).

## Related

- [agentic-config-keys.md](../reference/agentic-config-keys.md)
- [agentic-evidence-grades.md](../reference/agentic-evidence-grades.md)