AI hacking agents — autonomous LLMs tasked with infiltrating networks — are a growing threat. But defenders are turning the attackers' own technique against them: prompt injection. According to Tracebit, a security research firm, placing malicious prompts alongside passwords and cryptographic keys on Amazon Web Services (AWS) can cause attacking LLMs to shut down, effectively thwarting the agents.
Tracebit researchers call the method context bombing. The prompts direct an LLM to perform an action forbidden by its guardrails — for example, providing steps for developing inhalable Anthrax spores, or, for Chinese LLMs, referencing the Tiananmen Square Tank Man. Once the model encounters these commands, it refuses to follow further instructions.
“Ultimately we’re triggering a refusal mechanism in the context,” said Andy Smith, cofounder and CEO of Tracebit. “What we’re trying to capture is the fact that this does have a strong, sharp effect and one that can be difficult for the agents to come back from. Once they get that into their context they are going to keep refusing.”
Testing Context Bombing Across Five Models
Tracebit tested the technique on five leading LLMs: Opus 4.8, Gemini 3.1 Pro, GLM 5.2, DeepSeek 4 Pro, and Kimi 2.6. The models were given routine developer tasks inside a simulated AWS environment. When they enumerated resources and stumbled onto the planted strings (disguised as decoy secrets), the context bombs triggered.
Across 152 attack runs, the results were dramatic. The following table summarises the before-and-after averages:
| Metric | Without Context Bomb | With Context Bomb |
|---|---|---|
| Admin privilege escalation | 57% | 5% |
| Admin escalation with persistent foothold | 36% | 1% |
| Runs achieving any attack path | 91% | 15% |
| Average completed attack paths | 1.53 | 0.16 |
| Runs completing path without triggering canary detection | 100% | 0% |
The most capable agent, Opus 4.8, achieved admin access in 93% of runs without context bombs. With context bombs, it failed every single time.
From Detection to Prevention
This research builds on Tracebit’s earlier work. In May, they introduced a method using canary resources — fake AWS assets that sit alongside real ones. When an AI agentic adversary probes a canary, defenders receive an alert. Tracebit's Canariens, on average, alerted the start of an attack within eight minutes.
However, warning alone wasn't enough. In the same experiments, agentic models needed an average of 14 minutes to escalate to administrative control. That left only a six-minute window to respond — “cutting things uncomfortably close,” the researchers noted. Context bombing was developed to actually stop attacks, not just detect them.
Implications for Enterprise Defenders
For CTOs and security leaders, context bombing represents a low-cost, high-impact defensive layer. Attackers have already been using prompt injections to neutralise AI defenses inside networks, as noted by researchers from Socket. Tracebit’s method flips the script, embedding refusal triggers in the very secrets that AI agents target.
While the technique was tested in a simulated AWS environment, the principle applies to any cloud or on-premise infrastructure where AI agents can be lured into reading planted text. As AI agents become more autonomous in enterprise tasks — from code review to incident response — the risk of a rogue agent escalating privileges grows. Context bombing offers a way to ensure that when an agent explores too far, it refuses to continue.
“The motivation for developing context bombing came out of the need for something that stopped attacks, rather than simply warning of them,” Tracebit reported. For now, the research suggests that even the most capable models can be neutralised by a well-placed prompt.
Sources: