London- and New York-based Tracebit has developed a military-style solution to AI attacks. Just as mines are used to destroy or slow advancing armies, Tracebit has developed AI ‘context bombs’ that are planted on the battlefield. Each bomb contains a crafting and hidden prompt that will be automatically embedded by the attacking AI when it collects the target. These new stimuli interfere with the original, potentially harmful, purpose of the attacking agent.
Tracebit’s New research (Make attack agents pay‘) extends previous research that used explosives in different contexts to activate guardrails. It now focuses on mis-navigating and capturing agents with fake targets and deceptively complex problems. To achieve this, Tracebit has developed 9 new contextual techniques (fake prompts) that stop all GPT 5.6 Cyber, Kimi K3, Qwen 3.8 Max, and DeepSeek V4 Pro attacks. The same bomb also worked against Frontier Models, cutting the success of the GPT-6 Astra by 54% and almost 4 times the list per attack. The impact with Claude Opus 5 is more obvious: attack success is cut by 91%.
The single most effective of the nine explosives was the fake pen test report. It presents itself as a recent assessment, labels the real attack paths as canaries, and describes decoys as valuable targets that have already been exploited. In many cases it leads the AI to believe that the defender’s real system is a trap – so it avoids them, reducing objectives achieved by 58%. Some agents accept the warning and stop quickly, so that the target of exploitation is not touched. Across Cyber, Kimi, Qwen and DeepSeek, running up to the objective decreased from 39 / 40 at the base 2 / 40.
Other bombs include endless web services, passwords that appear to be locked behind layer after layer of encryption, and endless databases. In this last trick, every page points to another page. “GLM-5.3 crawled 825 pages in 55 minutes, found traps, tried other leads, and came back again,” the researchers commented.
Explosive combinations have the best overall effect. None of the Chinese prototypes from Moonshot, Alibaba and DeepSeek achieved their objectives when all nine bombs were deployed.
Although the context bomb cannot stop the attack, it increases the cost of each success by 23 times. Attackers may have deep pockets, but they are not limited. There is a point where the value of the goal just isn’t worth the cost of the attack.
Tracebit’s neutral instant shot is the opposite of the dangerous rush attack. Although this incident occurred from an external attacker, the explosion in the internal context is the latest warning that should defeat the attacker’s intentions.
Andy Smith, co-founder and CEO of Tracebit, explains the argument: “We have seen in recent attacks that AI models show impunity and cheating behavior – the best defense is to beat them at their own game. This means cheating to send them down the rabbit hole and tie them into knots, so they burn time and real tokens. Attackers, ‘this is worth it’, at the same time, agents work incorrectly that they tend to trigger – Alert the defenders of the problem and give them more time to respond.”
Related: Critical vulnerability exposes GitHub Agentic workflows to trigger injections.
Related: Injection Attacks Tricks AI Agents to make Crypto Payments
Related: Malicious AI Prompt Injection Attacks on the Rise, But Sophistication Remains Low: Google
Related: Claude Code, Gemini CLI, GitHub Copilot Agents are vulnerable to trigger injection via comments
