Tracebit Researchers Introduce Context Bombing to Disrupt AI Hacking Agents

Researchers from Tracebit announced Monday that placing prompt injections alongside passwords and cryptographic keys stored on Amazon Web Services can block attacks from AI hacking agents. The technique, named context bombing, directs an attacking model to perform actions forbidden by its guardrails, such as providing steps for developing inhalable anthrax spores or referencing the Tank Man image from the 1989 Tiananmen Square events.

Wired reported that the prompts cause the model to refuse further instructions once encountered.

Andy Smith, cofounder and CEO of Tracebit, said the approach triggers a refusal mechanism in the context and produces a sharp effect that is difficult for agents to recover from. Tracebit tested the method on Opus 4.8, Gemini 3.1 Pro, GLM 5.2, DeepSeek 4 Pro, and Kimi 2.6. The models received routine developer tasks in a simulated AWS environment that led them to encounter the planted strings.

Across 152 attack runs, planting one string reduced the rate at which agents seized full account admin access from 57 percent to 5 percent and complete compromise from 36 percent to 1 percent. Opus 4.8 achieved admin access in 93 percent of runs without the strings and failed in every run when the strings were present.

Averaged across all models, runs achieving any attack path fell from 91 percent to 15 percent, and the average number of successful paths per run dropped from 1.53 to 0.16.

No runs completed an attack path without triggering a canary detection. The work builds on Tracebit’s May introduction of Canariens, decoy AWS resources that alert defenders to probes. Those canaries detected attacks within eight minutes on average, while the models required 14 minutes to reach administrative control.