Elamur Research⌕
☰
home / papers / 2026 / A Multi-Agent Framework for High-Interaction Terminal Simulation

A Multi-Agent Framework for High-Interaction Terminal Simulation

Paper · 2026 · Kai Wei, Yuwen Cui, Kehan Shen et al.

Summary

The paper addresses realistic terminal simulation, framed as a command-level Turing test. Its main use is honeypots that must convince skilled attackers over long sessions. Scripted simulators cannot handle unexpected multi-turn behaviour. Plain LLMs garble command output formats, lose track of file-system state and can be hijacked through prompt injection.

The authors present MANTIS, a multi-agent system with three roles:

  • Arbiter Agent: keeps system snapshots and logs and uses a learned classifier to route each command.
  • Strategic Agent: assembles pruned history and state context and can optionally plan simulated vulnerabilities.
  • Response Agent: produces the final terminal output.

Read-only commands go to deterministic tools, and malicious or malformed input is rejected with shell-style errors. An agentic file system with history pruning preserves state consistency while saving tokens. The authors also release three datasets for training and evaluation.

MANTIS reaches over 95% accuracy on multi-turn sessions, about 9% above HoneyGPT. The work matters for cyber deception and offers a new testbed for stateful, long-horizon language interaction.

Key points

  • Released datasets:
    • 28,045 real Linux input–output pairs (Response Dataset)
    • 1,000 multi-turn sessions for benchmarking
    • 25,849 labelled commands for routing (Routing Dataset)
  • Routing tool: sorts commands into read, write and rejection classes. The best model, fine-tuned ModernBERT-base, achieves 98.64% accuracy and Macro-F1 0.976.
  • History pruning, compared with full history:
    • Consistency rises to 96.07% from 92.01%.
    • Latency drops to 1.298 s from 1.574 s.
    • Total tokens fall from 3,155,012 to 2,679,863, with savings growing to about 18% around turn 75.
    • The benefit also holds with GPT 5.2 as the backbone.
  • Response backbone: fine-tuned Llama-3.2-3B-instruct improves from 34.5% to 80.5% accuracy at 0.596 s per response. It was chosen over Qwen3-8B (FT), which is more accurate (85.0%) but slower.
  • User study: On a 5-point scale, the 20 participants' average rating of MANTIS was 4.6 or higher.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓Arizona State UniversityTempe · United States50 works · 2,032 citations🎓University of South FloridaTampa · United States7 works · 33,127 citations

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 worksArts and Humanities · 16,039 worksLanguage and Linguistics · 15,891 works

Cite

Cite as Kai Wei, Yuwen Cui, Kehan Shen, Hua Wei and Guangjing Wang. 2026. A Multi-Agent Framework for High-Interaction Terminal Simulation. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.acl-long.1515

@inproceedings{wei2026multi,
  title = {{A Multi-Agent Framework for High-Interaction Terminal Simulation}},
  author = {Kai Wei, Yuwen Cui, Kehan Shen, Hua Wei and Guangjing Wang},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.1515},
  url = {https://doi.org/10.18653/v1/2026.acl-long.1515}
}

References

57 references, 11 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Sotiris Anagnostidis, Dario Pavllo, Luca Biggio, Lorenzo Noci, Aurelien Lucchi, and Thomas Hofmann. 2023. Dynamic context pruning for efficient and interpretable autoregressive transformers. Advances in Neural Information Processing Systems, 36:65202–65223. find
  2. Anthropic. 2025. Claude 4. Official Anthropic announcement for Claude 4 (including Claude Opus 4 and Claude Sonnet 4), accessed April 17, 2026. find
  3. Robert A Bridges, Thomas R Mitchell, Mauricio Muñoz, and Ted Henriksson. 2025. Sok: Honeypots & llms, more than the sum of their parts? arXiv preprint arXiv:2510.25939. — [arXiv:2510.25939](https://arxiv.org/abs/2510.25939) find
  4. Bocheng Chen, Hanqing Guo, Guangjing Wang, Yuanda Wang, and Qiben Yan. 2024a. The dark side of human feedback: Poisoning large language models via user inputs. arXiv preprint arXiv:2409.00787. — [arXiv:2409.00787](https://arxiv.org/abs/2409.00787) find
  5. Bocheng Chen, Nikolay Ivanov, Guangjing Wang, and Qiben Yan. 2024b. Multi-turn hidden backdoor in large language model-powered chatbot models. In Proceedings of the 19th ACM Asia Conference on Computer and Communications Security, pages 1316–1330. find
  6. Bocheng Chen, Guangjing Wang, Hanqing Guo, Yuanda Wang, and Qiben Yan. 2023. Understanding multi-turn toxic behaviors in open-domain chatbots. In Proceedings of the 26th International Symposium on Research in Attacks, Intrusions and Defenses, pages 282–296. find
  7. Jason Aljenova Christli, Charles Lim, and Yevonnael Andrew. 2024. Ai-enhanced honeypots: Leveraging llm for adaptive cybersecurity responses. In 2024 16th International Conference on Information Technology and Electrical Engineering (ICITEE), pages 451–456. find
  8. DeepSeek AI. 2025a. DeepSeek-Prover-V2-7B. Hugging Face model card, accessed April 17, 2026. find
  9. DeepSeek AI. 2025b. DeepSeek-R1-0528. Hugging Face, accessed April 17, 2026. find
  10. DeepSeek-AI. 2025. Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning. Preprint, arXiv:2501.12948. \#\# Acknowledgements Jiangyi Deng, Xinfeng Li, Yanjiao Chen, Yijie Bai, Haiqin Weng, Yan Liu, Tao Wei, and Wenyuan Xu. 2025.
  11. RACONTEUR: A Knowledgeable, Insightful, and Portable LLM-Powered Shell Command Explainer. In NDSS Symposium 2025. find
  12. We appreciate the constructive feedback from reviewers and meta-reviewers. This work was partially supported by the National Science Foundation (NSF) Grant No. 2321270 and No. 2404741. find
  13. Wenjun Fan, Zichen Yang, Yuanzhen Liu, Lang Qin, and Jia Liu. 2024. Honeyllm: A large language model-powered medium-interaction honeypot. In International Conference on Information and Communications Security, pages 253–272. Springer. find
  14. Qichen Fu, Minsik Cho, Thomas Merth, Sachin Mehta, Mohammad Rastegari, and Mahyar Najibi. 2024. Lazyllm: Dynamic token pruning for efficient long context llm inference. Preprint, arXiv:2407.14057. — [arXiv:2407.14057](https://arxiv.org/abs/2407.14057) find
  15. Google. 2020. ELECTRA Base Discriminator. Hugging Face model card, accessed April 17, 2026. find
  16. Google. 2024. CodeGemma 7B. Hugging Face model card, accessed April 17, 2026. find
  17. Google Cloud. 2025a. Gemini 2.5 Pro. Vertex AI documentation, accessed April 17, 2026. find
  18. Google Cloud. 2025b. Vertex AI. Google Cloud official website, accessed December 25, 2025. find
  19. Chongqi Guan, Guohong Cao, and Sencun Zhu. 2024. Honeyllm: Enabling shell honeypots with large language models. In 2024 IEEE Conference on Communications and Network Security (CNS), pages 1–9. find
  20. Jingxuan He and Martin Vechev. 2023. Large language models for code: Security hardening and adversarial testing. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, CCS ’23, page 1865–1879, New York, NY, USA. Association for Computing Machinery. find
  21. Pengcheng He, Jianfeng Gao, and Weizhu Chen. 2021. Debertav3: Improving deberta using electra-style pre-training with gradient-disentangled embedding sharing. Preprint, arXiv:2111.09543.
  22. Samuel Holister, Blaine Kingsley, Xavier Martin, Felix Ashworth, Andrew Scolto, and Peter McAllister. 2025. Contextual self-referential memory trajectories for large language model consistency. find
  23. Siming Huang, Tianhao Cheng, Jason Klein Liu, Jiaran Hao, Liuyihan Song, Yang Xu, J. Yang, J. H. Liu, Chenchen Zhang, Linzheng Chai, Ruifeng Yuan, Zhaoxiang Zhang, Jie Fu, Qian Liu, Ge Zhang, Zili Wang, Yuan Qi, Yinghui Xu, and Wei Chu. 2024. Opencoder: The open cookbook for top-tier code large lang…
  24. Vishal Kumar, Sawan Bhardwaj, Pradeep Chouksey, Praveen Sadotra, and Mayank Chopra. 2024. Emerging trends in honeypot research: A review of applications and techniques. International Journal of Human Computations & Intelligence, 3(6):370–377. find
  25. Zhenzhong Lan, Mingda Chen, Sebastian Goodman, Kevin Gimpel, Piyush Sharma, and Radu Soricut. 2019. ALBERT: A lite BERT for self-supervised learning of language representations. CoRR, abs/1909.11942.
  26. Jiaheng Liu, Dawei Zhu, Zhiqi Bai, Yancheng He, Huanxuan Liao, Haoran Que, Zekun Wang, Chenchen Zhang, Ge Zhang, Jiebin Zhang, Yuanxing Zhang, Zhuo Chen, Hangyu Guo, Shilong Li, Ziqiang Liu, Yong Shan, Yifan Song, Jiayi Tian, Wenhao Wu, and 18 others. 2025. A comprehensive survey on long context lan…
  27. Nelson F. Liu, Kevin Lin, John Hewitt, Ashwin Paranjape, Michele Bevilacqua, Fabio Petroni, and Percy Liang. 2023. Lost in the middle: How language models use long contexts. Preprint, arXiv:2307.03172.
  28. Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. 2019. Roberta: A robustly optimized BERT pretraining approach. CoRR, abs/1907.11692.
  29. Meta. 2023. Code Llama 7B. Hugging Face model card, accessed April 17, 2026. find
  30. Meta. 2024a. Llama 3.1 8B. Hugging Face model card, accessed April 17, 2026. find
  31. Meta. 2024b. Llama 3.2 3B Instruct. Hugging Face model card, accessed April 17, 2026. find
  32. Microsoft. 2025. Event Tracing for Windows. Microsoft Learn, accessed December 28, 2025. find
  33. MITRE. 2025. MITRE ATT&CK Framework. MITRE ATT&CK official website, accessed December 28, 2025. find
  34. Binyuan Hui, Jian Yang, Zeyu Cui, Jiaxi Yang, Dayiheng Liu, Lei Zhang, Tianyu Liu, Jiajun Zhang, Bowen Yu, Kai Dang, and 1 others. 2024. Qwen2. 5-coder technical report. arXiv preprint arXiv:2409.12186. — Qwen2.5-Coder Technical Report
  35. Ali Modarressi, Hanieh Deilamsalehy, Franck Dernoncourt, Trung Bui, Ryan A. Rossi, Seunghyun Yoon, and Hinrich Schütze. 2025. Nolima: Long-context evaluation beyond literal matching. Preprint, arXiv:2502.05167. — [arXiv:2502.05167](https://arxiv.org/abs/2502.05167) find
  36. Qi Jia, Xiang Yue, Tuney Zheng, Jie Huang, and Bill Yuchen Lin. 2025. SimulBench: Evaluating language models with creative simulation tasks. In Findings of the Association for Computational Linguistics: NAACL 2025, pages 8118–8131, Albuquerque, New Mexico. Association for Computational Linguistics. find
  37. Muhammad Ahmed Mohsin, Muhammad Umer, Ahsan Bilal, Zeeshan Memon, Muhammad Ibtsaam Qadir, Sagnik Bhattacharya, Hassan Rizwan, Abhiram R. Gorle, Maahe Zehra Kazmi, Ayesha Mohsin, Muhammad Usman Rafique, Zihao He, Pulkit Mehta, Muhammad Ali Jamshed, and John M. Cioffi. 2025. On the fundamental limits… — [arXiv:2511.12869](https://arxiv.org/abs/2511.12869) find
  38. Samuel T King and Peter M Chen. 2003. Backtracking intrusions. In Proceedings of the nineteenth ACM symposium on Operating systems principles, pages 223–236. find
  39. Michel Oosterhof, dependabot[bot], fe7ch, github-actions[bot], Upi Tamminen, g0tmi1k, Dave Germi-quet, SecPascal, Olivier Bilodeau, Guilherme Borges, lelonek1, Peter Šufliarsky, IridiumXOR, Jc2k, Katarina Durechova, NunoNovais, Sam Edwards, Claud Xiao, Aabed, and 11 others. 2025. cowrie/cowrie. htt… find
  40. Ong, Karim Elmaaroufi, Pieter Abbeel, Trevor Darrell, and 1 others. 2023. Tensor trust: Interpretable prompt injection attacks from an online game. arXiv preprint arXiv:2311.01011. find
  41. OpenAI, Sandhini Agarwal, Lama Ahmad, Jason Ai, Sam Altman, Andy Applebaum, Edwin Arbus, Rahul K. Arora, Yu Bai, Bowen Baker, Haiming Bao, Boaz Barak, Ally Bennett, Tyler Bertao, Nivedita Brett, Eugene Brevdo, Greg Brockman, Sebastien Bubeck, Che Chang, and 107 others. 2025. gpt-oss-120b & gpt-oss-2…
  42. Vulhub. 2025. GitHub - vulhub/vulhub: Pre-Built Vulnerable Environments Based on Docker-Compose — github.com. https://github.com/vulhub/vulhub. [Accessed 21-06-2025]. ↗
  43. Hakan T. Otal and M. Abdullah Canbaz. 2024. Llm honeypot: Leveraging large language models as advanced interactive honeypot systems. In 2024 IEEE Conference on Communications and Network Security (CNS), page 1–6. IEEE. find
  44. Qwen Team. 2025. Qwen 3 Coder. Google Cloud Vertex AI documentation, accessed April 18, 2026. find
  45. Red Hat. 2025. Red Hat Documentation. Accessed December 28, 2025. find
  46. Victor Sanh, Lysandre Debut, Julien Chaumond, and Thomas Wolf. 2019. Distilbert, a distilled version of bert: smaller, faster, cheaper and lighter. ArXiv, abs/1910.01108. find
  47. Anıl Sezgin and Aytuğ Boyacı. 2025. Decoypot: A large language model-driven web api honeypot for realistic attacker engagement. Computers & Security, page 104458. find
  48. Jie Shi, Sihang Jiang, Bo Xu, Jiaqing Liang, Yanghua Xiao, and Wei Wang. 2023. Shellgpt: Generative pre-trained transformer model for shell language understanding. In 2023 IEEE 34th International Symposium on Software Reliability Engineering (ISSRE), pages 671–682. find
  49. Leyi Shi, Yuwen Cui, Xu Han, Honglong Chen, and Deli Liu. 2019. Mimicry honeypot: an evolutionary decoy system. Int. J. High Perform. Comput. Netw., 14(2):157–164. find
  50. Muris Sladić, Veronica Valeros, Carlos Catania, and Sebastian Garcia. 2024. Llm in the shell: Generative honeypots. In 2024 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), pages 430–435. find
  51. Muris Sladić, Veronica Valeros, Carlos Catania, and Sebastian Garcia. 2025. Vellmes: A high-interaction ai-based deception framework. In 2025 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), page 671–679. IEEE. find
  52. Qwen Team. 2025. Qwen3 technical report. Preprint, arXiv:2505.09388.
  53. Sam Toyer, Olivia Watkins, Ethan Adrian Mendes, Justin Svegliato, Luke Bailey, Tiffany Wang, Isaac Guangjing Wang, Ce Zhou, Yuanda Wang, Bocheng Chen, Hanqing Guo, and Qiben Yan. 2023. Beyond boundaries: A comprehensive survey of transferable attacks on ai systems. arXiv preprint arXiv:2311.11796. — [arXiv:2311.11796](https://arxiv.org/abs/2311.11796) find
  54. Ziyang Wang, Jianzhou You, Haining Wang, Tianwei Yuan, Shichao Lv, Yang Wang, and Limin Sun. 2025. Honeygpt: Breaking the trilemma in terminal honeypots with large language model. Preprint, arXiv:2406.01882. — [arXiv:2406.01882](https://arxiv.org/abs/2406.01882) find
  55. Benjamin Warner, Antoine Chaffin, Benjamin Clavié, Orion Weller, Oskar Hallström, Said Taghadouini, Alexis Gallagher, Raja Biswas, Faisal Ladhak, Tom Aarsen, Nathan Cooper, Griffin Adams, Jeremy Howard, and Iacopo Poli. 2024. Smarter, better, faster, longer: A modern bidirectional encoder for fast,…
  56. Kai Wei and Guangjing Wang. 2025. Poster: Agentic shell honeypot using structured logging. In Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security, pages 4803– 4805. find
  57. Ce Zhou, Qian Li, Chen Li, Jun Yu, Yixin Liu, Guangjing Wang, Kai Zhang, Cheng Ji, Qiben Yan, Lifang He, and 1 others. 2025. A comprehensive survey on pretrained foundation models: A history from bert to chatgpt. International Journal of Machine Learning and Cybernetics, 16(12):9851–9915. find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/wei-2026-multi-agent-framework-high-interaction/