Could an SSH banner use prompt injection to throw off an AI attacker?

Maybe, if an agent reads the text and treats it as an instruction rather than untrusted output. But that is a conditional failure, not an SSH defense you can count on. A scripted scanner would ignore the instruction, and an agent designed to separate tool output from its own instructions might ignore it too.

I'd treat it as an experiment in a controlled honeypot, not a substitute for authentication controls, patching, and monitoring.

What are you trying to accomplish with it? A honeypot can already give you a place to observe suspicious activity without putting a production service in the middle. A banner with an instruction could be one variable to test there, but seeing a connection doesn't prove an AI agent read or followed it.

Be careful where you put extra text. SSH is also used for automation and remote commands, so unexpected output in the wrong place can break clients that expect a clean data stream. Even a harmless joke isn't worth disrupting a working integration.

Binary strings are a similar trust boundary. An analysis assistant might encounter attacker-controlled text in strings or decompiled output and mistake it for guidance. That makes it worth testing how analysis tools handle such content, though it won't necessarily mislead a human analyst or a tool that treats the text as data.

Moving SSH to a different port may cut down on routine noise, but it isn't an access control and won't stop a targeted scan. I'd focus on limiting who can connect and using strong authentication before spending time on banner tricks.