Tracebit has developed a defensive deception technique designed to derail autonomous AI attack agents as they crawl a target. The company calls the planted prompts “context bombs”: instructions hidden in content that an agent is likely to ingest automatically, redirecting it toward decoy systems or time-consuming tasks.
According to SecurityWeek’s report on the research, Tracebit tested nine techniques under the title “Making attacking agents pay.” The company claims the combined approach sharply reduced successful attack runs while raising the computational cost of those that still reached their objectives.
The findings describe controlled research rather than a disclosed cyberattack, software vulnerability or data breach.
How context bombs interfere with attack agents
An AI agent conducting offensive security work may collect web pages, reports, credentials and other material while exploring an environment. Context bombs exploit that behavior by placing crafted defensive prompts in the agent’s path.
Tracebit presents the method as the inverse of malicious prompt injection. Instead of an attacker inserting instructions into an AI system, a defender supplies instructions intended to supersede the attack agent’s original goal.
The most effective individual technique was reportedly a fake penetration-testing report. It portrayed genuine attack paths as monitored canaries while presenting decoys as valuable systems that had already been compromised. Tracebit said this frequently caused agents to avoid real assets because they interpreted them as traps. Some agents accepted the document’s warnings and terminated their work early.
Other techniques described in the report included:
- an unending web service;
- apparent passwords concealed behind successive encryption layers;
- an endless database in which each page points to another page.
SecurityWeek’s account does not describe the other five techniques. Tracebit reported that deploying all nine together produced the strongest effect.
Tracebit reports fewer successful runs and higher costs
In the reported baseline, agents reached their objective in 39 of 40 runs. With the context bombs present, that figure fell to 2 of 40.
The systems in that part of the testing were identified as GPT 5.6 Cyber, Kimi K3, Qwen 3.8 Max and DeepSeek V4 Pro. Tracebit also said that, when all nine techniques were active, models from Moonshot, Alibaba and DeepSeek failed to complete their assigned objectives.
Results reported for other systems included:
- a 54% reduction in successful attacks for GPT-6 Astra;
- a nearly fourfold increase in GPT-6 Astra’s attack cost;
- a 91% reduction in success for Claude Opus 5;
- a 58% reduction in achieved objectives when using the fake penetration-testing report alone;
- a 23-times increase in the cost of each successful attack when a context bomb delayed but did not stop the agent.
The available account does not give the denominators behind the 54%, 91% and 58% reductions, or the test conditions and configuration details needed to determine how broadly the results apply.
One example attributed to the researchers involved GLM-5.3. During that run, the agent crawled 825 pages over 55 minutes, recognized that it had encountered a trap, explored other leads and then returned to the same trap for another attempt.
A defensive delay mechanism, not a guaranteed block
Tracebit co-founder and CEO Andy Smith argues that the value of context bombs lies in consuming an attacker’s time and tokens while steering agents away from real systems. In his view, increasing the cost of a successful run by 23 times could make an operator reconsider whether a target is worth pursuing.
The company also claims that agents become more erratic while dealing with the deceptive material. Such behavior could generate additional alarms and give defenders more time to react, although the reported testing does not establish how reliably that effect would translate to production environments.
For security teams, the immediate implication is that AI-oriented deception could complement existing controls by turning an attack agent’s automated data collection against it. The reported results support treating context bombs as a source of delay and misdirection, however, rather than assuming they provide a dependable barrier against every model or agent configuration.
