Tracebit research: deceptive 'context bombs' cut AI attack agent success, with up to 91% reduction against Claude Opus 5
Tracebit, a London- and New York-based security vendor, published research titled 'Making attacking agents pay' on defensive deception against autonomous AI attack agents. The approach plants hidden prompts, called 'context bombs', that an attacking agent ingests while crawling a target. These prompts misdirect the agent toward fake targets and deceptively complex problems. Tracebit developed nine techniques that stopped all attacks by GPT 5.6 Cyber, Kimi K3, Qwen 3.8 Max and DeepSeek V4 Pro. Against frontier models they cut GPT-6 Astra success by 54% and Claude Opus 5 success by 91%. Even when an attack was not stopped, the cost per success rose 23x. This is vendor research, not a reported intrusion.
Detalhes técnicos
- The most effective bomb was a fake pen testing report. It labeled real attack paths as canaries and described decoys as valuable, already-exploited targets. Agents then avoided real systems, cutting achieved objectives by 58%. Across Cyber, Kimi, Qwen and DeepSeek, runs reaching an objective fell from 39/40 at baseline to 2/40.
- Other bombs include an unending web service, passwords locked behind layers of encryption, and an endless database where every page points to another. GLM-5.3 crawled 825 pages in 55 minutes and kept returning to the trap.
- Deploying all nine bombs together stopped the Chinese models from Moonshot, Alibaba and DeepSeek from reaching any objective.
- The technique is the inverse of malicious prompt injection. The defender's context is the most recent input and is intended to override the attacker's intent.
- Erratic agent behavior is also more likely to trigger alarms, giving defenders more time to respond.
Remediação
The article presents deception-based defense as a mitigation: plant decoy targets and crafted prompts to waste attacker time and tokens and raise detection likelihood. No vulnerabilities or patches are involved. Results come from the vendor's own testing and have not been independently validated.
Linha do tempo
-
Tracebit research: deceptive 'context bombs' cut AI attack agent success, with up to 91% reduction against Claude Opus 5
ler a análise desta fonte ocultar
Tracebit, a London- and New York-based security vendor, published research titled 'Making attacking agents pay' on defensive deception against autonomous AI attack agents. The approach plants hidden prompts, called 'context bombs', that an attacking agent ingests while crawling a target. These prompts misdirect the agent toward fake targets and deceptively complex problems. Tracebit developed nine techniques that stopped all attacks by GPT 5.6 Cyber, Kimi K3, Qwen 3.8 Max and DeepSeek V4 Pro. Against frontier models they cut GPT-6 Astra success by 54% and Claude Opus 5 success by 91%. Even when an attack was not stopped, the cost per success rose 23x. This is vendor research, not a reported intrusion.
Technical Details
- The most effective bomb was a fake pen testing report. It labeled real attack paths as canaries and described decoys as valuable, already-exploited targets. Agents then avoided real systems, cutting achieved objectives by 58%. Across Cyber, Kimi, Qwen and DeepSeek, runs reaching an objective fell from 39/40 at baseline to 2/40.
- Other bombs include an unending web service, passwords locked behind layers of encryption, and an endless database where every page points to another. GLM-5.3 crawled 825 pages in 55 minutes and kept returning to the trap.
- Deploying all nine bombs together stopped the Chinese models from Moonshot, Alibaba and DeepSeek from reaching any objective.
- The technique is the inverse of malicious prompt injection. The defender's context is the most recent input and is intended to override the attacker's intent.
- Erratic agent behavior is also more likely to trigger alarms, giving defenders more time to respond.
Remediation
The article presents deception-based defense as a mitigation: plant decoy targets and crafted prompts to waste attacker time and tokens and raise detection likelihood. No vulnerabilities or patches are involved. Results come from the vendor's own testing and have not been independently validated.