Dynamic honeypots for computer program execution environments are described. A determination is made whether a time period has expired since a computer program execution environment, of multiple computer program execution environments, began executing a computer program that provides a user service. The computer program execution environment is changed into a computer security mechanism that counteracts an attempt of unauthorized use of a system that comprises the computer program execution environment, in response to a determination that the time period has expired since the computer program execution environment began executing the computer program that provides the user service.