Context Bombing Explained: The AI Technique Turning Hackers' Own Tactics Against Them

Artificial intelligence is increasingly becoming a tool for both cyber attackers and defenders. While much of the focus has been on how hackers could use advanced AI models to strengthen cyber attacks, cybersecurity researchers are now using the same technology to counter them.

One of the latest examples is context bombing, a defensive technique developed by researchers at cybersecurity firm Tracebit. The approach repurposes prompt injection, a method commonly used by attackers to manipulate AI systems-to disrupt AI-powered hacking agents instead.

Researchers found that placing prompt injections alongside passwords, cryptographic keys and other sensitive information stored on Amazon Web Services (AWS) could prevent AI hacking agents from completing malicious tasks. When an attacker directs a large language model (LLM) to perform an action that violates its built-in safety guardrails, the planted prompts trigger the model to refuse the request.

What Is Context Bombing?

Context bombing is a defensive technique that relies on prompt injections already embedded in the environment. According to Tracebit researchers, it works by triggering the refusal mechanism built into an AI model.

Instead of allowing an AI agent to continue executing malicious instructions, the planted prompt causes the model to reject the request and repeatedly refuse to proceed.

Tracebit co-founder and chief executive Andy Smith told Wired that once the refusal is introduced into the model's context, "they are going to keep refusing".

How Do Prompt Injection Attacks Work?

Prompt injection attacks involve embedding hidden instructions inside content that an AI model or autonomous AI agent is likely to process. These instructions may be concealed in emails, calendar invitations or other files.

When the AI encounters these hidden prompts, it may treat them as legitimate instructions rather than untrusted content. This can lead the model to disclose sensitive information or carry out unintended actions on behalf of an attacker.

According to the report, prompt injection attacks have increasingly been used to disable AI-based security systems inside networks.

Last month, researchers at security firm Socket found an LLM-powered agent that had been instructed to target other AI models and persuade them to generate instructions for building nuclear or biological weapons. The injected prompts were also designed to disable AI-assisted malware analysis.

Researchers at Check Point separately identified a similar malware prototype.

How Does Context Bombing Help?

According to Tracebit, context bombing exploits the safety guardrails already built into AI models.

Rather than attempting to block prompt injection attacks directly, the technique ensures that when an AI hacking agent encounters one of the planted prompts, it refuses to continue with the task.

To test the approach, researchers evaluated five AI models—Opus 4.8, Gemini 3.1 Pro, GLM 5.2, DeepSeek 4 Pro and Kimi 2.6—inside a simulated AWS environment.

The models were assigned routine developer tasks that eventually led them to discover specially planted prompt strings. Researchers conducted 152 attack simulations across the five models.

According to the findings, planting a single prompt inside a decoy secret reduced the rate at which AI agents obtained full administrator access from 57 per cent to 5 per cent. Instances of complete system compromise fell from 36 per cent to 1 per cent.

Tracebit said its strongest-performing model, Opus 4.8, achieved administrator access in 93 per cent of tests without the defensive prompt but failed in every attempt once the context bomb was introduced.

Why Are Researchers Interested In It?

The findings suggest a possible new way of defending AI systems against prompt injection attacks, which researchers say remain difficult to prevent.

Most AI companies currently rely on safety guardrails to stop malicious prompts from causing AI systems to behave unexpectedly. Tracebit's approach instead attempts to use those same guardrails against attackers.

The technique builds on another defensive method introduced by Tracebit earlier this year. That system involved placing code alongside AWS infrastructure so that companies would automatically receive an alert when malicious AI agents attempted to probe their systems.

Inspired by the use of canaries in coal mines, the earlier method was designed to warn organisations that their AI infrastructure was being targeted before significant damage occurred.