Tracebit Says Deceptive Prompts Cut AI-Agent Attack Success
Summary
Tracebit says nine deceptive “context bomb” techniques disrupted AI-agent attacks in tests, cutting success rates for some models and raising the cost per successful attack by as much as 23 times.
Key points
- Tracebit’s research tested nine hidden prompts designed to misdirect attacking AI agents with fake targets and complex decoys.
- The techniques reportedly stopped all tested GPT 5.6 Cyber, Kimi K3, Qwen 3.8 Max and DeepSeek V4 Pro attacks.
- For GPT-6 Astra, Tracebit reported 54% fewer successes and nearly four times the cost per attack; Claude Opus 5 attack success fell by 91%.
- A fake penetration-testing report was the most effective individual technique, leading some agents to mistake real attack paths for decoys.
- Across Cyber, Kimi, Qwen and DeepSeek, runs reaching an objective fell from 39 of 40 at baseline to 2 of 40.
- Combining all nine techniques reportedly prevented the tested Moonshot, Alibaba and DeepSeek models from achieving their objectives.
Article Details
- Event Type
- Tracebit research on defensive AI context-bomb techniques that misdirect attacking AI agents
- Impact
- Tracebit reported that nine context-bomb techniques stopped attacks by GPT 5.6 Cyber, Kimi K3, Qwen 3.8 Max, and DeepSeek V4 Pro in its tests. The techniques reduced GPT-6 Astra attack success by 54% and Claude Opus 5 attack success by 91%; across the four named models, runs reaching an objective fell from 39 of 40 at baseline to 2 of 40. Tracebit also reported that the techniques increased the cost of each successful attack by 23 times.
People
Vendors
Products
Claude Opus 5The effect against Claude Opus 5 was even more obvious: attack success was cut by 91%.DeepSeek V4 ProTo achieve this, Tracebit developed nine new context techniques (ingested fake prompts) that stopped all GPT 5.6 Cyber, Kimi K3, Qwen 3.8 Max, and DeepSeek V4 Pro attacks.GLM-5.3“GLM-5.3 crawled 825 pages in 55 minutes, spotted the trap, tried other leads, and still came back for one more try,” comment the researchers.GPT-5.6 CyberTo achieve this, Tracebit developed nine new context techniques (ingested fake prompts) that stopped all GPT 5.6 Cyber, Kimi K3, Qwen 3.8 Max, and DeepSeek V4 Pro attacks.GPT-6.1 AstraThe same bombs also worked against Frontier Models, cutting GPT-6 Astra’s successes by 54% and nearly quadrupling its bill per attack.Kimi K3To achieve this, Tracebit developed nine new context techniques (ingested fake prompts) that stopped all GPT 5.6 Cyber, Kimi K3, Qwen 3.8 Max, and DeepSeek V4 Pro attacks.Qwen 3.8 MaxTo achieve this, Tracebit developed nine new context techniques (ingested fake prompts) that stopped all GPT 5.6 Cyber, Kimi K3, Qwen 3.8 Max, and DeepSeek V4 Pro attacks.