Prompt injections, the malicious commands attackers embed into content to entice large language models to follow them, have been attackers’ go-to tool for turning AI platforms against their users. A well-phrased command sneaked into an email or calendar invitation is often all it takes to cause the LLM to exfiltrate sensitive data or follow other harmful actions.
However, researchers from Tracebit on Monday said they found that placing prompt injections alongside passwords, cryptographic keys, and other secrets stored on Amazon Web Services was often all that was needed to shut down attacks from AI hacking agents. The prompts direct the attacking LLM to perform an action forbidden by its guardrails, the safety barriers AI developers erect to prevent it from taking harmful actions.
The researchers have named the technique context bombing. “Ultimately we’re triggering a refusal mechanism in the context,” Andy Smith, co-founder and CEO of Tracebit, said when explaining the name choice. “What we’re trying to capture is the fact that this does have a strong, sharp effect and one that can be difficult for the agents to come back from. Once they get that into their context they are going to keep refusing.”
Initial Testing Suggests Great Potential
Tracebit says initial testing suggests context bombing has great potential. They tested Opus 4.8, Gemini 3.1 Pro, GLM 5.2, DeepSeek 4 Pro, and Kimi 2.6 by giving them instructions to perform routine developer tasks that led the models to enumerate resources and stumble onto the planted strings.
They ran the models inside a simulated AWS environment. “Across five leading models and 152 attack runs, planting one of these strings in a decoy secret cut the rate at which agents seized full account admin from 57% to 5%, and complete compromise (where they also left themselves a persistent foothold) from 36% to 1%,” Monday’s post reported.
Context Bombing: A New Defense Against AI Attacks
Averaged across the five models and the 152 runs, the results included:
* Admin privilege escalation fell from 57 percent to 5 percent
* Admin escalation with a persistent foothold fell from 36 percent to 1 percent
* Runs achieving any attack path fell from 91 percent to 15 percent
* On average, a run went from completing 1.53 paths successfully to just 0.16
No runs were able to complete an attack path without at least triggering a canary detection.
Context Bombing Builds on Previous Research
The research builds on findings from May, when Tracebit introduced a method for defenders to receive warnings when their infrastructure is under attack from AI agentic adversaries. It comes in the form of AWS resources that look like ones serving a legitimate purpose but, in fact, aren’t used at all.
They sit alongside the resources that are used. When they are probed by agentic AI, defenders receive an alert. Like “canaries” taken into coal mines, these resources allow defenders to detect a threat before it has fatal consequences.
Conclusion
Context bombing appears to be the first known case where defenders turned the tables on attackers using prompt injections. The technique has great potential in shutting down AI attacks and may provide a new defense against malicious AI activity.
Source: Original article