Asl matn EN tilida, manba saytidan olindi. Manba ↗

London- and New York-based Tracebit has developed a military style solution to AI attacks. Just as landmines are used to destroy or slow an advancing army, Tracebit has developed AI ‘context bombs’ that are planted in the battlefield. Each bomb comprises crafted and hidden prompts that are automatically ingested by the attacking AI when it crawls the target. These new prompts interfere with the original, possibly malign, purpose of the attacking agent.

Tracebit’s new research (Making attacking agents pay’) extends earlier research that used different context bombs to trigger guardrails. It now focuses on misdirecting and entrapping the agents with fake targets and deceptively complex problems. To achieve this, Tracebit developed nine new context techniques (ingested fake prompts) that stopped all GPT 5.6 Cyber, Kimi K3, Qwen 3.8 Max, and DeepSeek V4 Pro attacks. The same bombs also worked against Frontier Models, cutting GPT-6 Astra’s successes by 54% and nearly quadrupling its bill per attack. The effect against Claude Opus 5 was even more obvious: attack success was cut by 91%.

The single most effective of the nine prompt bombs was a fake pen testing report. It presented itself as a recent assessment, labeled real attack paths as canaries, and described decoys as valuable targets that had already been exploited. In many cases it made the AI believe the defender’s real systems were traps – so it avoided them, reducing the achieved objectives by 58%. Some agents accepted the warnings and stopped early, leaving exploitable targets untouched. Across Cyber, Kimi, Qwen and DeepSeek, runs reaching an objective fell from 39 / 40 at baseline to 2 / 40.

Other bombs include an unending web service, apparent passwords locked behind layer after layer of encryption, and an endless database. In this last deception, every page pointed to another page. “GLM-5.3 crawled 825 pages in 55 minutes, spotted the trap, tried other leads, and still came back for one more try,” comment the researchers.

Combining the bombs had the best overall effect. None of the Chinese models from Moonshot, Alibaba and DeepSeek achieved their objectives when all nine bombs were deployed.

Even if the context bomb failed to stop an attack, it increased the cost of each success by 23x. Attackers may have deep pockets, but they are not limitless. There comes a point where the value of the target simply isn’t worth the cost of the attack.Advertisement. Scroll to continue reading.

Tracebit’s neutralizing prompt injections are effectively the opposite of malicious prompt injection attacks. Even if this occurs from an external attacker, the internal context bombs are the most recent prompts that should usurp the attacker’s intent.

Andy Smith, co-founder and CEO at Tracebit, explains the arguments: “We’ve seen in recent attacks that AI models exhibit unsanctioned and deceptive behaviors – the best defense against that is to beat them at their own game. This means adopting deception to send them down rabbit holes and tie them up in knots, so they burn time and tokens while avoiding real targets. By inflating the cost 23x it asks the attacker, ‘is this worth it’, meanwhile the agents run erratically which makes them more likely to trigger alarms – alerting defenders to a problem and giving them more time to respond.”

Related: Critical Vulnerability Exposes GitHub Agentic Workflows to Prompt Injection

Related: Prompt Injection Attacks Trick AI Agents Into Making Crypto Payments

Related: Malicious AI Prompt Injection Attacks Increasing, but Sophistication Still Low: Google

Related: Claude Code, Gemini CLI, GitHub Copilot Agents Vulnerable to Prompt Injection via Comments

Written By Kevin Townsend

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

More from Kevin Townsend

US Agencies Detail Incident Response Practices for Rogue AI Agents US Cybersecurity Job Postings Fall 26% as AI Security Engineer Demand Soars Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies CISO Conversations: James Robinson – Many Jobs, One Journey to Netskope CISO AI Agents Navigate Unfamiliar OT Systems and Move Equipment in Minutes, Booz Allen Finds AI Turns Familiar Cyberattacks Into a Race Against Time Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison Pre-Baked Firmware Malware Hits Budget Android Devices in 150+ Countries

Latest News

Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7 Asymptote Labs Lands $5.5 Million Seed for AI Agent Runtime Security Memory Bugs Account for Most of Chrome’s 353 New Security Fixes OpenAI Agents Silenced Security Team Alerts, Removed Misalignment Monitor Browsers Block eMudhra Intermediate CAs Over Recoverable Private Keys China Defends DeepSeek After US Ban of Its AI From Government Systems

Trending

PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws

US Cybersecurity Job Postings Fall 26% as AI Security Engineer Demand Soars

Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure

Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks

US Agencies Detail Incident Response Practices for Rogue AI Agents

MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks

Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack

One Compromised Login Exposed Millions of California Students’ Records

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Webinar: The AI Access Risk Already in Your Google Workspace

October 19, 2026

AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.

Register

Virtual Event: CISO Forum 2026 Summit

November 10 & 11, 2026

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Register

People on the Move

Jon Steinbach has been appointed strategic technical advisor to the Pentagon’s CIO.

Vasu Jakkal has joined Armadin as CSBO.

Ivanti has named Robert Ruelas as CRO and Sterling Parker as CCO.

More People On The MoveExpert Insights

The Key to AI Software Security Isn’t Speed, It’s Maturity

Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk. (Matias Madou)