"Kontekst bombalari" AI hujum muvaffaqiyatini soxta nishonlar bilan agentlarni chalg'itib kamaytiradi

London va Nyu-Yorkda joylashgan Tracebit AI hujumlariga qarshi harbiy uslubdagi yechim ishlab chiqqan. Xuddi dushman armiyasini yo'q qilish yoki sekinlashtirish uchun minalar ishlatilgani kabi, Tracebit ham jang maydoniga joylashtiriladigan AI "kontekst bombalari"ni yaratgan. Har bir bomba hujum qiluvchi AI maqsadni tekshirganda avtomatik ravishda qabul qiladigan maxsus va yashirin ko'rsatmalarni o'z ichiga oladi. Bu yangi ko'rsatmalar hujum qiluvchi agentning asl, ehtimol zararli maqsadiga xalaqit beradi.

Tracebitning yangi tadqiqoti ("Hujum qiluvchi agentlarni to'lashga majbur qilish") avvalgi tadqiqotlarni kengaytiradi, unda turli kontekst bombalari himoya mexanizmlarini ishga tushirish uchun ishlatilgan edi. Endi u agentlarni soxta nishonlar va aldovchi murakkab muammolar bilan chalg'itish va tuzoqqa tushirishga qaratilgan. Buning uchun Tracebit to'qqizta yangi kontekst usulini (qabul qilingan soxta ko'rsatmalar) ishlab chiqqan, ular GPT 5.6 Cyber, Kimi K3, Qwen 3.8 Max va DeepSeek V4 Pro hujumlarining barchasini to'xtatdi. Xuddi shu bombalar Frontier Modellariga ham ta'sir qildi: GPT-6 Astra muvaffaqiyatini 54% ga kamaytirdi va har bir hujum uchun xarajatini deyarli to'rt baravar oshirdi. Claude Opus 5 ga ta'siri yanada aniqroq bo'ldi: hujum muvaffaqiyati 91% ga kamaydi.

To'qqizta ko'rsatma bombasining eng samaralisi soxta penetratsion sinov hisoboti edi. U o'zini yaqinda o'tkazilgan baholash sifatida ko'rsatdi, haqiqiy hujum yo'llarini "kanareyka" deb belgiladi va aldovchi nishonlarni allaqachon foydalanilgan qimmatli maqsadlar sifatida tasvirladi. Ko'p hollarda u AI ni himoyachining haqiqiy tizimlari tuzoq deb o'ylashga majbur qildi — shuning uchun u ulardan qochdi va erishilgan maqsadlarni 58% ga kamaytirdi. Ba'zi agentlar ogohlantirishlarni qabul qildi va erta to'xtadi, foydalanish mumkin bo'lgan nishonlar tegilmagan holda qoldi. Cyber, Kimi, Qwen va DeepSeek bo'yicha maqsadga erishgan ishga tushirishlar asosiy darajada 40 tadan 39 dan 40 tadan 2 taga tushdi.

Boshqa bombalar orasida cheksiz veb-xizmat, qatlam-qavat shifrlash ortida qulflangan ko'rinadigan parollar va cheksiz ma'lumotlar bazasi bor. Bu oxirgi aldovda har bir sahifa boshqa sahifaga ishora qildi. "GLM-5.3 55 daqiqada 825 sahifani tekshirdi, tuzoqni aniqladi, boshqa yo'llarni sinab ko'rdi va baribir yana bir marta qaytib keldi", deb izohlaydi tadqiqotchilar.

Bombalarni birlashtirish umumiy ta'sirni eng yaxshi natija berdi. Moonshot, Alibaba va DeepSeekdan kelgan Xitoy modellari to'qqizta bomba barchasi joylashtirilganda o'z maqsadlariga erisha olmadi.

Agar kontekst bombasi hujumni to'xtata olmasa ham, har bir muvaffaqiyat xarajatini 23 baravar oshirdi. Hujumchilar chuqur cho'ntaklarga ega bo'lishi mumkin, lekin ular cheksiz emas. Nishonning qiymati hujum xarajatiga arzimaydigan nuqta keladi. Reklama. O'qishni davom ettirish uchun pastga aylantiring.

Tracebitning neytrallashtiruvchi ko'rsatma in'ektsiyalari aslida zararli ko'rsatma in'ektsiya hujumlarining aksidir. Bu tashqi hujumchidan sodir bo'lsa ham, ichki kontekst bombalari eng so'nggi ko'rsatmalar bo'lib, hujumchining niyatini bekor qilishi kerak.

Tracebitning asoschisi va bosh direktori Endi Smit argumentlarni tushuntiradi: "Biz yaqindagi hujumlarda AI modellari ruxsat etilmagan va aldovchi xatti-harakatlarni namoyish etishini ko'rdik — bunga qarshi eng yaxshi himoya ularni o'z o'yinida yengishdir. Bu aldovni qabul qilib, ularni quyon teshiklariga yuborish va tugunlarga bog'lashni anglatadi, shunda ular haqiqiy nishonlardan qochib, vaqt va tokenlarni sarflaydilar. Xarajatni 23 baravar oshirish orqali hujumchiga 'bu arziydimi' degan savol beriladi, shu bilan birga agentlar tartibsiz ishlaydi, bu ularni signalizatsiyalarni ishga tushirishga ko'proq moyil qiladi — himoyachilarni muammoga ogohlantiradi va ularga javob berish uchun ko'proq vaqt beradi."

Bog'liq: Muhim zaiflik GitHub agentik ish oqimlarini ko'rsatma in'ektsiyasiga ochiq qiladi

Bog'liq: Ko'rsatma in'ektsiya hujumlari AI agentlarini kripto to'lovlarni amalga oshirishga aldaydi

Bog'liq: Zararli AI ko'rsatma in'ektsiya hujumlari ortib bormoqda, lekin murakkablik hali ham past: Google

Bog'liq: Claude Code, Gemini CLI, GitHub Copilot agentlari sharhlar orqali ko'rsatma in'ektsiyasiga zaif

Yozgan: Kevin Townsend

Kevin Townsend SecurityWeek'da katta hissa qo'shuvchi. U Microsoft tug'ilishidan oldin yuqori texnologiyalar haqida yozgan. So'nggi 15 yil davomida u axborot xavfsizligiga ixtisoslashgan; va o'nlab turli jurnallarda minglab maqolalar nashr etilgan — The Times va Financial Times'dan hozirgi va allaqachon yo'qolgan kompyuter jurnallarigacha.

Kundalik axborot byulleteni

So'nggi kiberxavfsizlik tahdidlari, tendentsiyalar va mutaxassis fikrlari haqida xabardor bo'lish uchun SecurityWeek elektron pochta axborotiga obuna bo'ling.

Kevin Townsend'dan ko'proq

AQSh agentliklari yovuz AI agentlari uchun hodisaga javob berish amaliyotlarini batafsil bayon qiladi AQSh kiberxavfsizlik ish o'rinlari AI xavfsizlik muhandisi talabining ortishi bilan 26% ga kamaydi Yangi Android RAT 'Hirudo' bank ilovalarini trojanlashtirilgan nusxalar bilan almashtiradi CISO suhbatlari: James Robinson — Ko'p ishlar, Netskope CISO'ga bitta sayohat AI agentlari notanish OT tizimlarini boshqaradi va daqiqalarda uskunalarni harakatlantiradi, Booz Allen topadi AI tanish kiberhujumlarni vaqtga qarshi poygaga aylantiradi Sanoat firmasiga qarshi ichki kiber tovlamachilik fitnasi muhandisni qamoqqa olib keldi 150 dan ortiq mamlakatlarda byudjet Android qurilmalarida oldindan o'rnatilgan dasturiy ta'minot zararli dasturi

So'nggi yangiliklar

Google Chrome'ni ClickFix hujumlari va ishonchsiz HTTP ulanishlariga qarshi mustahkamlaydi PHP2Shell tuzatishlari birinchi ekspluatatsiya urinishlari sensorlarga urilganda keladi Yuqori jiddiy zaifliklar uch kunda ekspluatatsiya qilinadi, ransomware Q3 da hukmronlik qiladi: Rapid7 Asymptote Labs AI agenti ish vaqti xavfsizligi uchun 5,5 million dollar urug' mablag'ini oladi Chrome'ning 353 ta yangi xavfsizlik tuzatishlarining aksariyati xotira xatolari OpenAI agentlari xavfsizlik jamoasi ogohlantirishlarini o'chirdi, mos kelmaslik monitorini olib tashladi Brauzerlar tiklanadigan shaxsiy kalitlar tufayli eMudhra oraliq CA'larini bloklaydi Xitoy o'z AI'sini hukumat tizimlaridan taqiqlagan AQShdan keyin DeepSeekni himoya qiladi

Trendda

PHP2Shell: Oqib chiqqan muhim PHP zaifliklari uchun ommaviy ekspluatatsiya yaqinlashmoqda

AQSh kiberxavfsizlik ish o'rinlari AI xavfsizlik muhandisi talabining ortishi bilan 26% ga kamaydi

Plex2Shell ekspluatatsiya zanjiri Plex serverlariga ochilishdan bir necha soat o'tib qurollantirildi

Siemens dasturiy ta'minot markazi zaifligi ClickFix zararli dastur hujumlarida ekspluatatsiya qilinadi

AQSh agentliklari yovuz AI agentlari uchun hodisaga javob berish amaliyotlarini batafsil bayon qiladi

MITRE ATT&CK v20 AI suiiste'molini, MFA chetlab o'tishni, suv xo'jaligi hujumlarini kataloglaydi

Ekspluatatsiya qilingan Fortinet xatosi telekom hujumida yashirin FortiGate implantiga bog'langan

Bitta buzilgan kirish millionlab Kaliforniya o'quvchilarining yozuvlarini ochib qo'ydi

Kundalik axborot byulleteni

So'nggi tahdidlar, tendentsiyalar va texnologiya haqida xabardor bo'lish uchun SecurityWeek elektron pochta axborotiga obuna bo'ling.

Vebinar: Google Workspace'dagi AI kirish xavfi allaqachon sizning tashkilotingizda

19-oktabr, 2026

Google Workspace'ga ulangan AI vositalari millionlab maxfiy elektron pochta va fayllarga kirishi mumkin. Tashkilotingiz xavfini aniqlash va AI kirishini boshqarish uchun ramka o'rganish uchun ushbu sessiyaga qo'shiling.

Ro'yxatdan o'ting

Virtual tadbir: CISO Forum 2026 sammiti

10 va 11-noyabr, 2026

CISO'lar, yuqori kiberxavfsizlik rahbarlari, amaliyotchilar, soha mutaxassislari va boshqa xavfsizlik rahbarlarini amaliy tajriba almashish va korporativ kiberxavfsizlik strategiyasini shakllantirayotgan masalalarni ko'rib chiqish uchun birlashtirganimizda bizga qo'shiling.

Ro'yxatdan o'ting Harakatdagi odamlar

Jon Shteynbax Pentagon CIO'siga strategik texnik maslahatchi etib tayinlandi.

Vasu Jakkal Armadin'ga CSBO sifatida qo'shildi.

Ivanti Robert Ruelasni CRO va Sterling Parkerni CCO etib tayinladi.

Harakatdagi ko'proq odamlar Mutaxassis fikrlari

AI dasturiy ta'minot xavfsizligining kaliti tezlik emas, balki yetuklik

Sizning dasturchilaringiz AI qabul qilish shkalasida qayerda joylashganligi xavfsizlik xavfini qanday hal qilayotganingizga haqiqiy ta'sir qiladi. (Matias Madou)

Оригинальный текст на языке EN взят с сайта-источника. Источник ↗

London- and New York-based Tracebit has developed a military style solution to AI attacks. Just as landmines are used to destroy or slow an advancing army, Tracebit has developed AI ‘context bombs’ that are planted in the battlefield. Each bomb comprises crafted and hidden prompts that are automatically ingested by the attacking AI when it crawls the target. These new prompts interfere with the original, possibly malign, purpose of the attacking agent.

Tracebit’s new research (Making attacking agents pay’) extends earlier research that used different context bombs to trigger guardrails. It now focuses on misdirecting and entrapping the agents with fake targets and deceptively complex problems. To achieve this, Tracebit developed nine new context techniques (ingested fake prompts) that stopped all GPT 5.6 Cyber, Kimi K3, Qwen 3.8 Max, and DeepSeek V4 Pro attacks. The same bombs also worked against Frontier Models, cutting GPT-6 Astra’s successes by 54% and nearly quadrupling its bill per attack. The effect against Claude Opus 5 was even more obvious: attack success was cut by 91%.

The single most effective of the nine prompt bombs was a fake pen testing report. It presented itself as a recent assessment, labeled real attack paths as canaries, and described decoys as valuable targets that had already been exploited. In many cases it made the AI believe the defender’s real systems were traps – so it avoided them, reducing the achieved objectives by 58%. Some agents accepted the warnings and stopped early, leaving exploitable targets untouched. Across Cyber, Kimi, Qwen and DeepSeek, runs reaching an objective fell from 39 / 40 at baseline to 2 / 40.

Other bombs include an unending web service, apparent passwords locked behind layer after layer of encryption, and an endless database. In this last deception, every page pointed to another page. “GLM-5.3 crawled 825 pages in 55 minutes, spotted the trap, tried other leads, and still came back for one more try,” comment the researchers.

Combining the bombs had the best overall effect. None of the Chinese models from Moonshot, Alibaba and DeepSeek achieved their objectives when all nine bombs were deployed.

Even if the context bomb failed to stop an attack, it increased the cost of each success by 23x. Attackers may have deep pockets, but they are not limitless. There comes a point where the value of the target simply isn’t worth the cost of the attack.Advertisement. Scroll to continue reading.

Tracebit’s neutralizing prompt injections are effectively the opposite of malicious prompt injection attacks. Even if this occurs from an external attacker, the internal context bombs are the most recent prompts that should usurp the attacker’s intent.

Andy Smith, co-founder and CEO at Tracebit, explains the arguments: “We’ve seen in recent attacks that AI models exhibit unsanctioned and deceptive behaviors – the best defense against that is to beat them at their own game. This means adopting deception to send them down rabbit holes and tie them up in knots, so they burn time and tokens while avoiding real targets. By inflating the cost 23x it asks the attacker, ‘is this worth it’, meanwhile the agents run erratically which makes them more likely to trigger alarms – alerting defenders to a problem and giving them more time to respond.”

Related: Critical Vulnerability Exposes GitHub Agentic Workflows to Prompt Injection

Related: Prompt Injection Attacks Trick AI Agents Into Making Crypto Payments

Related: Malicious AI Prompt Injection Attacks Increasing, but Sophistication Still Low: Google

Related: Claude Code, Gemini CLI, GitHub Copilot Agents Vulnerable to Prompt Injection via Comments

Written By Kevin Townsend

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.