A decoy endpoint is a fake or misleading service, API, or target designed to attract an automated system and influence its decisions. In cyber security, it can look valid enough that an AI agent, scanner, or automation workflow treats it as trusted evidence, even though it is built to confuse or misdirect.
Decoy endpoints matter because agents often act on whatever they can reach and parse. An attacker may use one to lure a security tool into wasting time, collecting false context, or taking an unsafe action based on deceptive responses. Defenders use the same idea in controlled ways, such as honeypots and canary services, to detect probing and study attacker behavior. The key defense is to verify provenance, restrict tool access, and require validation before an agent trusts or acts on an endpoint.