Security Researchers Turn Prompt Injection Against AI Hackers, Cutting Attack Success Rate From 57% to 5%

A Weapon Built for Attackers Gets Turned Around

Prompt injection has spent the last few years as the tool bad actors use to hijack AI systems. Bury a malicious command in an email, a calendar invite, or a webpage, and a large language model reading that content will often follow the hidden instruction instead of the user's actual request. Security researchers at Tracebit now say defenders can use the same trick, according to Ars Technica.

The method, which Tracebit calls "context bombing," works by planting decoy secrets inside cloud storage on Amazon Web Services. These decoys look like real passwords or cryptographic keys, the kind an AI hacking agent would try to steal once it breaks into a system. But hidden inside the decoy is a command instructing the LLM to do something its safety guardrails forbid, such as producing instructions for making inhalable anthrax spores, or, for Chinese-developed models, referencing Tank Man from the 1989 Tiananmen Square massacre.

Once the AI agent reads that forbidden text, it triggers a refusal response built into the model. According to Andy Smith, Tracebit's co-founder and CEO, that refusal tends to stick. "Ultimately we're triggering a refusal mechanism in the context," Smith told Ars Technica. "What we're trying to capture is the fact that this does have a strong, sharp effect and one that can be difficult for the agents to come back from. Once they get that into their context they are going to keep refusing."

The Numbers

Tracebit tested the technique against five leading models: Opus 4.8, Gemini 3.1 Pro, GLM 5.2, DeepSeek 4 Pro, and Kimi 2.6. Researchers set up a simulated AWS environment and gave each model routine developer tasks designed to lead it toward the planted decoy strings, mimicking how an actual attacking agent might enumerate cloud resources while hunting for credentials to escalate access.

Across five models and 152 attack runs, planting a single tainted decoy secret cut the rate at which agents achieved full account admin access from 57% to 5%, according to Tracebit's findings as reported by Ars Technica. Complete compromise, meaning the agent both gained admin access and planted a persistent foothold for later return, dropped from 36% to 1%.

The most capable model tested, Opus 4.8, showed the starkest swing. It achieved admin access in 93% of runs without the countermeasure. With the context bomb in place, it failed in every single run.

Building on Earlier Canary Work

Tracebit's May research introduced a related concept: planting fake AWS resources that look legitimate but serve no real function, acting as tripwires. When an AI agent probes one of these decoy resources, defenders get an alert, similar to how canaries once warned coal miners of dangerous gas. Context bombing extends that idea by not just alerting defenders but actively disabling the attacking agent mid-operation.

The approach is notable because it doesn't require patching a vulnerability or changing network architecture. It exploits a property already built into every major commercial LLM: refusal training meant to stop the model from generating dangerous content. Attackers rely on jailbreaking those same guardrails to make models do harmful things. Defenders, in Tracebit's approach, rely on those guardrails holding.

What's Unproven and What's Next

Tracebit's numbers come from its own controlled testing, not from an independent third-party audit or a peer-reviewed study, so the 57%-to-5% figure should be read as one firm's internal research rather than an industry-verified benchmark. It's also unclear how well context bombing holds up against attacking agents specifically engineered to recognize and route around decoy content, something that would likely happen quickly once the technique becomes widely known, since publishing the method also tips off the adversaries it's designed to stop.

There's also an open question about durability. Model developers routinely patch and retrain their systems, and a refusal trigger that works against Opus 4.8 or DeepSeek 4 Pro today may not survive the next model update. Tracebit has not said whether it's in contact with Anthropic, Google, Zhipu AI (maker of GLM), DeepSeek, or Moonshot AI (maker of Kimi) about the vulnerability its own technique exploits in their guardrail systems.

No regulatory body has weighed in on context bombing, and no AI company has publicly commented on the findings.