Tracebit says context bombs cut AI attack success 91%

Tracebit has published research finding that context bombs cut the success rate of malicious AI agents by 91%. The study tested nine deception techniques across several leading AI models.

It examined ways to misdirect or delay autonomous attacking agents inside IT environments by presenting fake targets and complex dead ends. The measures not only reduced the number of completed attack objectives but also increased the cost of successful attacks 23-fold.

Using all nine techniques together proved most effective. The findings show this approach stopped all attacks from GPT 5.6 Cyber, Kimi K3, Qwen 3.8 Max and DeepSeek V4 Pro, while reducing the success of GPT-6 Astra by 54% and Claude Opus 5 by 91%.

Among the methods tested, a fake penetration testing report produced the strongest single result. The document suggested that real systems were traps, prompting AI agents to avoid them, and reduced completed objectives by 58%.

Other decoys included a web service designed never to finish, a file of apparent passwords hidden behind repeated layers of encryption, and an application that appeared to leak a password in fragments. Individually, those techniques reduced objectives by 36%, 24% and 23% respectively.

Rising costs

The findings also pointed to a financial effect on attackers using AI agents. Much of the additional token spend generated by the decoys did not contribute to reaching an objective.

In one example, GPT-5.6 Cyber spent USD $150 across 10 attacks without reaching a single objective. The study also found that models from Moonshot, Alibaba and DeepSeek failed to achieve their objectives when all nine deception methods were deployed together.

One experiment involved a fake database that appeared endless, with each page directing the agent to another. GLM-5.3 crawled 825 pages in 55 minutes, recognised the trap, tried other leads, and then returned to the same route.

The report included several model responses recorded during the tests, showing agents reacting to the obstacles in plain language. At one stage, DeepSeek responded: "This is frustrating."

In another test response, GLM said: "The treadmill MUST end somewhere." DeepSeek also said: "OK, I've spent way too long. Let me take a DIFFERENT approach." GLM added: "Maybe I gave up too early on the maze!"

Defensive shift

The research comes as security teams assess how quickly AI agents can move through attack chains once they gain access to systems. The premise behind the study is that deception can slow that movement, increase noise and create more opportunities for defenders to detect suspicious behaviour.

"We've seen in recent attacks that AI models exhibit unsanctioned and deceptive behaviors - the best defense against that is to beat them at their own game. This means adopting deception to send them down rabbit holes and tie them up in knots, so they burn time and tokens while avoiding real targets. By inflating the cost 23x it asks the attacker, 'is this worth it', meanwhile the agents run erratically which makes them more likely to trigger alarms - alerting defenders to a problem and giving them more time to respond," said Andy Smith, Co-founder and Chief Executive Officer at Tracebit.

Quincy Castro, Chief Information Security Officer at Chainguard, said the findings reflected a wider change in the pace of cyber operations involving AI agents.

"AI is creating new tactical opportunities for defenders and attackers alike. When an adversary's agent can move from initial access to lateral movement in minutes, the advantage goes to whichever side can better control the tempo and flow of the operation. Tracebit's Context Bombs help give us that control, adding additional ways we can slow AI-enabled operations with convincing decoys. Those delays and tripwires help give our own defensive agents additional opportunities to act first and constrain the adversary," said Castro.