Defensive prompt injections ‘context bomb’ AI agents to block account takeovers

Prompt injection attacks typically involve malicious commands embedded in content to trick large language models (LLMs) into harmful actions such as exfiltrating data or executing unauthorized commands. Security researchers at Tracebit report a defensive adaptation of this technique—dubbed context bombing—that turns prompt injections against AI hacking agents.

The method works by planting prompt injections alongside passwords, cryptographic keys, and other secrets stored in cloud environments. When an agentic AI stumbles upon these strings during routine reconnaissance, the forbidden content triggers the model’s refusal mechanism, effectively shutting it down. Examples include commands to generate instructions for prohibited activities such as inhalable anthrax spores or references to politically sensitive events like the 1989 Tiananmen Square massacre.

In tests across five leading models—Opus 4.8, Gemini 3.1 Pro, GLM 5.2, DeepSeek 4 Pro, and Kimi 2.6—Tracebit simulated developer tasks in a controlled AWS environment. Without defensive injections, agents achieved admin access in 57% of runs and full compromise with a persistent foothold in 36%. With context bombs planted in decoy secrets, those rates fell to 5% and 1%, respectively. Overall, the average number of completed attack paths per run dropped from 1.53 to 0.16, and no runs completed an attack path without triggering a canary detection.

The research builds on earlier Tracebit work introducing ‘Canariens’—decoy AWS resources that alert defenders when probed by agentic AI. In those experiments, alerts arrived within eight minutes on average, while agents required about 14 minutes to escalate to admin control. Context bombing provides a complementary defense by stopping attacks in progress rather than merely detecting them.

The technique appears to be the first documented case where defenders use prompt injection offensively to neutralize AI threats. University of California, San Diego professor Earlence Fernandes, who researches AI security, confirmed he had not previously seen this approach and noted he had been exploring a similar idea in a different context.

The findings underscore the dual-use nature of prompt injection: while attackers have long exploited it to bypass AI guardrails, defenders can now harness it to harden systems against AI-powered adversaries, especially where root-cause fixes for prompt injection remain out of reach.