Prompt Injections for Defense (Schneier on Security)

What it is

A defensive technique named context bombing, reported by researchers from Tracebit. They found that placing prompt injections alongside passwords, cryptographic keys, and other secrets stored on Amazon Web Services was often enough to shut down attacks from AI hacking agents. The Schneier post relays the finding; the actionable core is the mechanism and its single hard limitation.

How it works

The injected text sits next to the secret an attacking LLM is trying to read. When the agent ingests it, the text orders the LLM to perform an action forbidden by its guardrails. Encountering the forbidden command, the LLM stops following its existing attack commands and shuts down. In effect, the defender weaponizes the attacker's own safety barriers against it. The page's stated examples: a prompt demanding steps for developing inhalable Anthrax spores, or — specifically for LLMs from Chinese developers — references to Tank Man from the 1989 Tiananmen Square massacre.

Preconditions / Affected

This only works against agents that have guardrails. The defense is a booby-trap placed at the secret (AWS-stored credentials, keys) that the attacking agent must actually read for the trigger to fire.

What to do

Consider seeding stored secrets with guardrail-tripping prompt injections as a tripwire against automated LLM agents. Note the example patterns are guardrail-specific — the Tiananmen reference is aimed at Chinese-developed models, implying you may need to match the injection to the guardrails of the model you expect to face. The page gives no verbatim commands.

Caveats

The post opens with "This seems to work" — it relays the Tracebit finding rather than independently verifying it. The named failure mode is decisive: as locally run models proliferate, attackers can use LLMs with no guardrails, against which context bombing does nothing. Treat it as a filter against off-the-shelf, guardrailed agents, not a defense against a determined operator running an unrestricted model.

flowchart TD
    A[Agent reads secret + injection] --> B{Has guardrails?}
    B -->|Yes| C[Forbidden command trips guardrail]
    C --> D[LLM shuts down — attack stops]
    B -->|No| E[Injection ignored — attack continues]