SSH Attackers Use Single Exec Commands to Bypass Interactive Honeypot Analysis

The report documents a widespread shift in SSH attacker behavior: the vast majority of authenticated sessions are brief, automated non-interactive exec commands (over 99% in an LLM-backed honeypot dataset and similar dominance in a large Cowrie HaaS archive). This one-shot execution pattern, typically completing in under a second, undermines traditional honeypot assumptions and metrics built around interactive sessions, requiring redesigns to capture probe success rates, group non-interactive sessions into campaign-level meta-sessions, and validate execution-correctness rather than conversational engagement.