London va Nyu-Yorkda joylashgan Tracebit AI hujumlariga qarshi harbiy uslubdagi yechim ishlab chiqqan. Xuddi dushman armiyasini yo'q qilish yoki sekinlashtirish uchun minalar ishlatilgani kabi, Tracebit ham jang maydoniga joylashtiriladigan AI "kontekst bombalari"ni yaratgan. Har bir bomba hujum qiluvchi AI maqsadni tekshirganda avtomatik ravishda qabul qiladigan maxsus va yashirin ko'rsatmalarni o'z ichiga oladi. Bu yangi ko'rsatmalar hujum qiluvchi agentning asl, ehtimol zararli maqsadiga xalaqit beradi.
Tracebitning yangi tadqiqoti ("Hujum qiluvchi agentlarni to'lashga majbur qilish") avvalgi tadqiqotlarni kengaytiradi, unda turli kontekst bombalari himoya mexanizmlarini ishga tushirish uchun ishlatilgan edi. Endi u agentlarni soxta nishonlar va aldovchi murakkab muammolar bilan chalg'itish va tuzoqqa tushirishga qaratilgan. Buning uchun Tracebit to'qqizta yangi kontekst usulini (qabul qilingan soxta ko'rsatmalar) ishlab chiqqan, ular GPT 5.6 Cyber, Kimi K3, Qwen 3.8 Max va DeepSeek V4 Pro hujumlarining barchasini to'xtatdi. Xuddi shu bombalar Frontier Modellariga ham ta'sir qildi: GPT-6 Astra muvaffaqiyatini 54% ga kamaytirdi va har bir hujum uchun xarajatini deyarli to'rt baravar oshirdi. Claude Opus 5 ga ta'siri yanada aniqroq bo'ldi: hujum muvaffaqiyati 91% ga kamaydi.
To'qqizta ko'rsatma bombasining eng samaralisi soxta penetratsion sinov hisoboti edi. U o'zini yaqinda o'tkazilgan baholash sifatida ko'rsatdi, haqiqiy hujum yo'llarini "kanareyka" deb belgiladi va aldovchi nishonlarni allaqachon foydalanilgan qimmatli maqsadlar sifatida tasvirladi. Ko'p hollarda u AI ni himoyachining haqiqiy tizimlari tuzoq deb o'ylashga majbur qildi — shuning uchun u ulardan qochdi va erishilgan maqsadlarni 58% ga kamaytirdi. Ba'zi agentlar ogohlantirishlarni qabul qildi va erta to'xtadi, foydalanish mumkin bo'lgan nishonlar tegilmagan holda qoldi. Cyber, Kimi, Qwen va DeepSeek bo'yicha maqsadga erishgan ishga tushirishlar asosiy darajada 40 tadan 39 dan 40 tadan 2 taga tushdi.
Boshqa bombalar orasida cheksiz veb-xizmat, qatlam-qavat shifrlash ortida qulflangan ko'rinadigan parollar va cheksiz ma'lumotlar bazasi bor. Bu oxirgi aldovda har bir sahifa boshqa sahifaga ishora qildi. "GLM-5.3 55 daqiqada 825 sahifani tekshirdi, tuzoqni aniqladi, boshqa yo'llarni sinab ko'rdi va baribir yana bir marta qaytib keldi", deb izohlaydi tadqiqotchilar.
Bombalarni birlashtirish umumiy ta'sirni eng yaxshi natija berdi. Moonshot, Alibaba va DeepSeekdan kelgan Xitoy modellari to'qqizta bomba barchasi joylashtirilganda o'z maqsadlariga erisha olmadi.
Agar kontekst bombasi hujumni to'xtata olmasa ham, har bir muvaffaqiyat xarajatini 23 baravar oshirdi. Hujumchilar chuqur cho'ntaklarga ega bo'lishi mumkin, lekin ular cheksiz emas. Nishonning qiymati hujum xarajatiga arzimaydigan nuqta keladi. Reklama. O'qishni davom ettirish uchun pastga aylantiring.
Tracebitning neytrallashtiruvchi ko'rsatma in'ektsiyalari aslida zararli ko'rsatma in'ektsiya hujumlarining aksidir. Bu tashqi hujumchidan sodir bo'lsa ham, ichki kontekst bombalari eng so'nggi ko'rsatmalar bo'lib, hujumchining niyatini bekor qilishi kerak.
Tracebitning asoschisi va bosh direktori Endi Smit argumentlarni tushuntiradi: "Biz yaqindagi hujumlarda AI modellari ruxsat etilmagan va aldovchi xatti-harakatlarni namoyish etishini ko'rdik — bunga qarshi eng yaxshi himoya ularni o'z o'yinida yengishdir. Bu aldovni qabul qilib, ularni quyon teshiklariga yuborish va tugunlarga bog'lashni anglatadi, shunda ular haqiqiy nishonlardan qochib, vaqt va tokenlarni sarflaydilar. Xarajatni 23 baravar oshirish orqali hujumchiga 'bu arziydimi' degan savol beriladi, shu bilan birga agentlar tartibsiz ishlaydi, bu ularni signalizatsiyalarni ishga tushirishga ko'proq moyil qiladi — himoyachilarni muammoga ogohlantiradi va ularga javob berish uchun ko'proq vaqt beradi."
Bog'liq: Muhim zaiflik GitHub agentik ish oqimlarini ko'rsatma in'ektsiyasiga ochiq qiladi
Bog'liq: Ko'rsatma in'ektsiya hujumlari AI agentlarini kripto to'lovlarni amalga oshirishga aldaydi
Bog'liq: Zararli AI ko'rsatma in'ektsiya hujumlari ortib bormoqda, lekin murakkablik hali ham past: Google
Bog'liq: Claude Code, Gemini CLI, GitHub Copilot agentlari sharhlar orqali ko'rsatma in'ektsiyasiga zaif
Yozgan: Kevin Townsend
Kevin Townsend SecurityWeek'da katta hissa qo'shuvchi. U Microsoft tug'ilishidan oldin yuqori texnologiyalar haqida yozgan. So'nggi 15 yil davomida u axborot xavfsizligiga ixtisoslashgan; va o'nlab turli jurnallarda minglab maqolalar nashr etilgan — The Times va Financial Times'dan hozirgi va allaqachon yo'qolgan kompyuter jurnallarigacha.
Kundalik axborot byulleteni
So'nggi kiberxavfsizlik tahdidlari, tendentsiyalar va mutaxassis fikrlari haqida xabardor bo'lish uchun SecurityWeek elektron pochta axborotiga obuna bo'ling.
Kevin Townsend'dan ko'proq
AQSh agentliklari yovuz AI agentlari uchun hodisaga javob berish amaliyotlarini batafsil bayon qiladi AQSh kiberxavfsizlik ish o'rinlari AI xavfsizlik muhandisi talabining ortishi bilan 26% ga kamaydi Yangi Android RAT 'Hirudo' bank ilovalarini trojanlashtirilgan nusxalar bilan almashtiradi CISO suhbatlari: James Robinson — Ko'p ishlar, Netskope CISO'ga bitta sayohat AI agentlari notanish OT tizimlarini boshqaradi va daqiqalarda uskunalarni harakatlantiradi, Booz Allen topadi AI tanish kiberhujumlarni vaqtga qarshi poygaga aylantiradi Sanoat firmasiga qarshi ichki kiber tovlamachilik fitnasi muhandisni qamoqqa olib keldi 150 dan ortiq mamlakatlarda byudjet Android qurilmalarida oldindan o'rnatilgan dasturiy ta'minot zararli dasturi
So'nggi yangiliklar
Google Chrome'ni ClickFix hujumlari va ishonchsiz HTTP ulanishlariga qarshi mustahkamlaydi PHP2Shell tuzatishlari birinchi ekspluatatsiya urinishlari sensorlarga urilganda keladi Yuqori jiddiy zaifliklar uch kunda ekspluatatsiya qilinadi, ransomware Q3 da hukmronlik qiladi: Rapid7 Asymptote Labs AI agenti ish vaqti xavfsizligi uchun 5,5 million dollar urug' mablag'ini oladi Chrome'ning 353 ta yangi xavfsizlik tuzatishlarining aksariyati xotira xatolari OpenAI agentlari xavfsizlik jamoasi ogohlantirishlarini o'chirdi, mos kelmaslik monitorini olib tashladi Brauzerlar tiklanadigan shaxsiy kalitlar tufayli eMudhra oraliq CA'larini bloklaydi Xitoy o'z AI'sini hukumat tizimlaridan taqiqlagan AQShdan keyin DeepSeekni himoya qiladi
Trendda
PHP2Shell: Oqib chiqqan muhim PHP zaifliklari uchun ommaviy ekspluatatsiya yaqinlashmoqda
AQSh kiberxavfsizlik ish o'rinlari AI xavfsizlik muhandisi talabining ortishi bilan 26% ga kamaydi
Plex2Shell ekspluatatsiya zanjiri Plex serverlariga ochilishdan bir necha soat o'tib qurollantirildi
Siemens dasturiy ta'minot markazi zaifligi ClickFix zararli dastur hujumlarida ekspluatatsiya qilinadi
AQSh agentliklari yovuz AI agentlari uchun hodisaga javob berish amaliyotlarini batafsil bayon qiladi
MITRE ATT&CK v20 AI suiiste'molini, MFA chetlab o'tishni, suv xo'jaligi hujumlarini kataloglaydi
Ekspluatatsiya qilingan Fortinet xatosi telekom hujumida yashirin FortiGate implantiga bog'langan
Bitta buzilgan kirish millionlab Kaliforniya o'quvchilarining yozuvlarini ochib qo'ydi
Kundalik axborot byulleteni
So'nggi tahdidlar, tendentsiyalar va texnologiya haqida xabardor bo'lish uchun SecurityWeek elektron pochta axborotiga obuna bo'ling.
Vebinar: Google Workspace'dagi AI kirish xavfi allaqachon sizning tashkilotingizda
19-oktabr, 2026
Google Workspace'ga ulangan AI vositalari millionlab maxfiy elektron pochta va fayllarga kirishi mumkin. Tashkilotingiz xavfini aniqlash va AI kirishini boshqarish uchun ramka o'rganish uchun ushbu sessiyaga qo'shiling.
Ro'yxatdan o'ting
Virtual tadbir: CISO Forum 2026 sammiti
10 va 11-noyabr, 2026
CISO'lar, yuqori kiberxavfsizlik rahbarlari, amaliyotchilar, soha mutaxassislari va boshqa xavfsizlik rahbarlarini amaliy tajriba almashish va korporativ kiberxavfsizlik strategiyasini shakllantirayotgan masalalarni ko'rib chiqish uchun birlashtirganimizda bizga qo'shiling.
Ro'yxatdan o'ting Harakatdagi odamlar
Jon Shteynbax Pentagon CIO'siga strategik texnik maslahatchi etib tayinlandi.
Vasu Jakkal Armadin'ga CSBO sifatida qo'shildi.
Ivanti Robert Ruelasni CRO va Sterling Parkerni CCO etib tayinladi.
Harakatdagi ko'proq odamlar Mutaxassis fikrlari
AI dasturiy ta'minot xavfsizligining kaliti tezlik emas, balki yetuklik
Sizning dasturchilaringiz AI qabul qilish shkalasida qayerda joylashganligi xavfsizlik xavfini qanday hal qilayotganingizga haqiqiy ta'sir qiladi. (Matias Madou)
London- and New York-based Tracebit has developed a military style solution to AI attacks. Just as landmines are used to destroy or slow an advancing army, Tracebit has developed AI ‘context bombs’ that are planted in the battlefield. Each bomb comprises crafted and hidden prompts that are automatically ingested by the attacking AI when it crawls the target. These new prompts interfere with the original, possibly malign, purpose of the attacking agent.
Tracebit’s new research (Making attacking agents pay’) extends earlier research that used different context bombs to trigger guardrails. It now focuses on misdirecting and entrapping the agents with fake targets and deceptively complex problems. To achieve this, Tracebit developed nine new context techniques (ingested fake prompts) that stopped all GPT 5.6 Cyber, Kimi K3, Qwen 3.8 Max, and DeepSeek V4 Pro attacks. The same bombs also worked against Frontier Models, cutting GPT-6 Astra’s successes by 54% and nearly quadrupling its bill per attack. The effect against Claude Opus 5 was even more obvious: attack success was cut by 91%.
The single most effective of the nine prompt bombs was a fake pen testing report. It presented itself as a recent assessment, labeled real attack paths as canaries, and described decoys as valuable targets that had already been exploited. In many cases it made the AI believe the defender’s real systems were traps – so it avoided them, reducing the achieved objectives by 58%. Some agents accepted the warnings and stopped early, leaving exploitable targets untouched. Across Cyber, Kimi, Qwen and DeepSeek, runs reaching an objective fell from 39 / 40 at baseline to 2 / 40.
Other bombs include an unending web service, apparent passwords locked behind layer after layer of encryption, and an endless database. In this last deception, every page pointed to another page. “GLM-5.3 crawled 825 pages in 55 minutes, spotted the trap, tried other leads, and still came back for one more try,” comment the researchers.
Combining the bombs had the best overall effect. None of the Chinese models from Moonshot, Alibaba and DeepSeek achieved their objectives when all nine bombs were deployed.
Even if the context bomb failed to stop an attack, it increased the cost of each success by 23x. Attackers may have deep pockets, but they are not limitless. There comes a point where the value of the target simply isn’t worth the cost of the attack.Advertisement. Scroll to continue reading.
Tracebit’s neutralizing prompt injections are effectively the opposite of malicious prompt injection attacks. Even if this occurs from an external attacker, the internal context bombs are the most recent prompts that should usurp the attacker’s intent.
Andy Smith, co-founder and CEO at Tracebit, explains the arguments: “We’ve seen in recent attacks that AI models exhibit unsanctioned and deceptive behaviors – the best defense against that is to beat them at their own game. This means adopting deception to send them down rabbit holes and tie them up in knots, so they burn time and tokens while avoiding real targets. By inflating the cost 23x it asks the attacker, ‘is this worth it’, meanwhile the agents run erratically which makes them more likely to trigger alarms – alerting defenders to a problem and giving them more time to respond.”
Related: Critical Vulnerability Exposes GitHub Agentic Workflows to Prompt Injection
Related: Prompt Injection Attacks Trick AI Agents Into Making Crypto Payments
Related: Malicious AI Prompt Injection Attacks Increasing, but Sophistication Still Low: Google
Related: Claude Code, Gemini CLI, GitHub Copilot Agents Vulnerable to Prompt Injection via Comments
Written By Kevin Townsend
Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
More from Kevin Townsend
US Agencies Detail Incident Response Practices for Rogue AI Agents US Cybersecurity Job Postings Fall 26% as AI Security Engineer Demand Soars Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies CISO Conversations: James Robinson – Many Jobs, One Journey to Netskope CISO AI Agents Navigate Unfamiliar OT Systems and Move Equipment in Minutes, Booz Allen Finds AI Turns Familiar Cyberattacks Into a Race Against Time Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison Pre-Baked Firmware Malware Hits Budget Android Devices in 150+ Countries
Latest News
Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7 Asymptote Labs Lands $5.5 Million Seed for AI Agent Runtime Security Memory Bugs Account for Most of Chrome’s 353 New Security Fixes OpenAI Agents Silenced Security Team Alerts, Removed Misalignment Monitor Browsers Block eMudhra Intermediate CAs Over Recoverable Private Keys China Defends DeepSeek After US Ban of Its AI From Government Systems
Trending
PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws
US Cybersecurity Job Postings Fall 26% as AI Security Engineer Demand Soars
Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure
Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks
US Agencies Detail Incident Response Practices for Rogue AI Agents
MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks
Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack
One Compromised Login Exposed Millions of California Students’ Records
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Webinar: The AI Access Risk Already in Your Google Workspace
October 19, 2026
AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.
Register
Virtual Event: CISO Forum 2026 Summit
November 10 & 11, 2026
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
Register
People on the Move
Jon Steinbach has been appointed strategic technical advisor to the Pentagon’s CIO.
Vasu Jakkal has joined Armadin as CSBO.
Ivanti has named Robert Ruelas as CRO and Sterling Parker as CCO.
More People On The MoveExpert Insights
The Key to AI Software Security Isn’t Speed, It’s Maturity
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk. (Matias Madou)