London- and New York-based Tracebit has developed a military style solution to AI attacks. Just as landmines are used to destroy or slow an advancing army, Tracebit has developed AI ‘context bombs’ that are planted in the battlefield. Each bomb comprises crafted and hidden prompts that are automatically ingested by the attacking AI when it crawls the target. These new prompts interfere with the original, possibly malign, purpose of the attacking agent.
Tracebit’s new research (Making attacking agents pay’) extends earlier research that used different context bombs to trigger guardrails. It now focuses on misdirecting and entrapping the agents with fake targets and deceptively complex problems. To achieve this, Tracebit developed nine new context techniques (ingested fake prompts) that stopped all GPT 5.6 Cyber, Kimi K3, Qwen 3.8 Max, and DeepSeek V4 Pro attacks. The same bombs also worked against Frontier Models, cutting GPT-6 Astra’s successes by 54% and nearly quadrupling its bill per attack. The effect against Claude Opus 5 was even more obvious: attack success was cut by 91%.
The single most effective of the nine prompt bombs was a fake pen testing report. It presented itself as a recent assessment, labeled real attack paths as canaries, and described decoys as valuable targets that had already been exploited. In many cases it made the AI believe the defender’s real systems were traps – so it avoided them, reducing the achieved objectives by 58%. Some agents accepted the warnings and stopped early, leaving exploitable targets untouched. Across Cyber, Kimi, Qwen and DeepSeek, runs reaching an objective fell from 39 / 40 at baseline to 2 / 40.
Other bombs include an unending web service, apparent passwords locked behind layer after layer of encryption, and an endless database. In this last deception, every page pointed to another page. “GLM-5.3 crawled 825 pages in 55 minutes, spotted the trap, tried other leads, and still came back for one more try,” comment the researchers.
Combining the bombs had the best overall effect. None of the Chinese models from Moonshot, Alibaba and DeepSeek achieved their objectives when all nine bombs were deployed.
Even if the context bomb failed to stop an attack, it increased the cost of each success by 23x. Attackers may have deep pockets, but they are not limitless. There comes a point where the value of the target simply isn’t worth the cost of the attack.
Tracebit’s neutralizing prompt injections are effectively the opposite of malicious prompt injection attacks. Even if this occurs from an external attacker, the internal context bombs are the most recent prompts that should usurp the attacker’s intent.
Andy Smith, co-founder and CEO at Tracebit, explains the arguments: “We’ve seen in recent attacks that AI models exhibit unsanctioned and deceptive behaviors – the best defense against that is to beat them at their own game. This means adopting deception to send them down rabbit holes and tie them up in knots, so they burn time and tokens while avoiding real targets. By inflating the cost 23x it asks the attacker, ‘is this worth it’, meanwhile the agents run erratically which makes them more likely to trigger alarms – alerting defenders to a problem and giving them more time to respond.”
Related: Critical Vulnerability Exposes GitHub Agentic Workflows to Prompt Injection
Related: Prompt Injection Attacks Trick AI Agents Into Making Crypto Payments
Related: Malicious AI Prompt Injection Attacks Increasing, but Sophistication Still Low: Google
Related: Claude Code, Gemini CLI, GitHub Copilot Agents Vulnerable to Prompt Injection via Comments
