TRACEBIT , a London- and New York-based company, has unveiled a set of “context bombs” designed to mislead AI attack agents by placing deceptive prompts into target environments. Their approach uses nine new context techniques that feed attackers false prompts and decoys, steering the agents away from real objectives.
In their tests, these bombs interrupted attacks across multiple widely used models, including GPT 5.6 Cyber, Kimi K3, Qwen 3.8 Max, and DeepSeek V4 Pro, and also reduced success against frontier models such as GPT-6 Astra by 54% and nearly quadrupled the cost per attack. The most effective prompt was a fake pen-testing report that portrayed real attack paths as canaries and described decoys as already exploited targets, leading the AI to treat defender systems as traps and avoid pursuing them.
Overall, attack success plummeted from 39/40 at baseline to 2/40 when nine bombs were deployed, with some agents abandoning operations mid‑course after warnings. When combined, the bombs prevented any objective from being reached for several Chinese models from Moonshot, Alibaba and DeepSeek, while even successful attacks cost attackers 23 times more.
The researchers described several bomb types, including an unending web service, passwords locked behind successive layers of encryption, and an endlessly linked database that directs the agent from page to page. They also noted that even when a bomb did not fully stop an attack, it raised the cost and slowed progress, increasing the likelihood of alarms being triggered and giving defenders more time to respond.
Tracebit positions these contextual prompts as the antithesis of malicious prompt injections, arguing that deploying such neutralising prompts can help defenders beat attackers at their own game by tying them up in rabbit holes and exhausting their resources.