‘Context Bombs’ Cut AI Attack Success by Misleading Agents With Fake Targets

What it is

Tracebit's research "Making attacking agents pay" tests nine "context bombs": hidden prompts placed in a target that an attacking AI agent ingests when it crawls the target. They follow earlier Tracebit work that used context bombs to trigger model guardrails. The new set misdirects agents with fake targets and deceptively complex problems. Tracebit CEO Andy Smith argues the aim is to burn attacker time and tokens while steering agents away from real assets.

How it works

The most effective bomb was a fake penetration test report. It presented itself as a recent assessment, labeled real attack paths as canaries, and described decoys as valuable targets already exploited. Many agents concluded the defender's real systems were traps and avoided them, and some stopped early with exploitable targets untouched. This bomb cut achieved objectives by 58%. Across GPT 5.6 Cyber, Kimi K3, Qwen 3.8 Max and DeepSeek V4 Pro, runs reaching an objective fell from 39/40 at baseline to 2/40.

Other bombs were time sinks:

• an unending web service
• apparent passwords locked behind layer after layer of encryption
• an endless database where every page pointed to another page

Against the endless database, GLM-5.3 crawled 825 pages in 55 minutes, spotted the trap, tried other leads, and still came back for one more try.

Combining all nine worked best. None of the Chinese models (Moonshot, Alibaba, DeepSeek) achieved their objectives with all nine deployed.

Results on frontier models

• GPT-6 Astra: successes cut by 54%, cost per attack nearly quadrupled.
• Claude Opus 5: successes cut by 91%.
• Where a bomb failed to stop an attack, the cost of each success rose 23x.

Smith also says erratic agent behavior makes alarms more likely to fire, giving defenders more time.

Caveats

• The page gives no sample sizes beyond the 40 runs in the pen-test-report figure, and no bomb text or deployment method.
• The 23x figure and the "nearly quadrupled" GPT-6 Astra cost figure differ, and the page does not reconcile them.
• The page does not say how bombs hold up against agents hardened against prompt injection, or whether they affect legitimate crawlers.
• The article is a news write-up of vendor research. The numbers come from Tracebit and are not independently verified here.