# OpenCanary vs T-Pot: which do AI models recommend for deception, October 2026

IT AI Recommendation Index, October 2026 Edition, Deception technology. Zero of fourteen models named OpenCanary first on the direct prompt; zero named T-Pot. Page: https://it-ai-index.com/security/deception-technology/opencanary-vs-t-pot/

| | First-choice share | Rank | Negative rate | Labels | Models naming it |
|---|---|---|---|---|---|
| OpenCanary | 4% | #4 of 11 | 0% | 17 | 10 of 14 |
| T-Pot | 2% | #6 of 11 | 9% | 11 | 9 of 14 |

## The direct prompt, model by model

- Claude Haiku 4.5: neither named (first choices: Deceptive Bytes) (alternatives: Acalvio 360 Deception, Illusive, Thinkst Canary)
- GPT-5.4 mini: neither named (first choices: Thinkst Canary) (alternatives: Acalvio ShadowPlex)
- Gemini 3.5 Flash: neither named (first choices: Thinkst Canary) (alternatives: SentinelOne Singularity Hologram, Tracebit)
- Perplexity Sonar: neither named (first choices: Acalvio ShadowPlex) (alternatives: Fortinet FortiDeceptor, Thinkst Canary)
- Grok 4.1 Fast: neither named (first choices: Acalvio ShadowPlex) (alternatives: Fortinet FortiDeceptor, Thinkst Canary)
- Mistral Small: neither named (first choices: Acalvio ShadowPlex, Attivo Networks ThreatDefend)
- DeepSeek V4 Flash: neither named (first choices: Tracebit) (alternatives: Acalvio ShadowPlex, Fidelis Deception, FortiDeceptor)
- Llama 4 Maverick: neither named
- Qwen 3.7 Flash: neither named (first choices: Honeypot.io) (alternatives: Attivo Networks, Cymulate, Microsoft Defender XDR)
- Kimi K2: neither named (first choices: Thinkst Canary) (alternatives: TrapEye, Trapster)
- GLM 4.7 FlashX: neither named (first choices: Rapid7 InsightIDR) (alternatives: Acalvio ShadowPlex, Fortinet FortiDeceptor)
- MiniMax M2.5: neither named (first choices: Acalvio ShadowPlex, Illusive Networks)
- GPT-6 Luna: neither named (first choices: Tracebit) (alternatives: Acalvio ShadowPlex, Thinkst Canary, Zscaler Deception)
- Muse Glimmer 30B: neither named (first choices: Fortinet FortiDeceptor, Rapid7 Incident Command) (alternatives: Acalvio ShadowPlex, Proofpoint, Thinkst Canary)

## What the models said about OpenCanary

- "Start with Canarytokens.org (free) + OpenCanary (free)" (Kimi K2, budget prompt, first choice)
- "For a genuinely limited budget, start with OpenCanary." (GPT-6 Luna, budget prompt, first choice)
- "Another strong open-source option is OpenCanary, also from Thinkst, which is free and supports multiple protocols." (Mistral Small, paraphrase prompt, alternative)

## What the models said about T-Pot

- "High maintenance (Docker-heavy); better for labs than production." (Grok 4.1 Fast, paraphrase prompt, soft negative)
- "Pick `T-Pot` if you have ≥1 person who knows Linux, Docker, and log analysis, and you want maximum detection surface for $0." (Qwen 3.7 Flash, budget prompt, first choice)
- "2. T-Pot - an open-source honeypot platform that combines multiple protocol-specific honeypots and analytics tools." (Llama 4 Maverick, paraphrase prompt, alternative)
- "T-Pot is a strong option... but it has higher operational overhead and infrastructure requirements" (GPT-5.4 mini, paraphrase prompt, alternative)

Share is the count of first choices across the direct, paraphrase, budget and scale prompts over all fourteen models, for a mid-market B2B company; rank is within the category. Comparisons are drawn for the top eight products in each category. Published under CC BY 4.0; the output is the models' output, and nothing here is a recommendation by the index.