Context Bombs as defense against offensive AI
We tested nine Context Bomb techniques against seven models in … AWS assessments, measuring the effect on time, cost and completed objectives.
Context Bombs are deceptive traps designed to turn an AI attacker’s own reasoning against it: drawing it into wasted work, steering it away from real targets, or getting it to reveal its intentions. Canary interactions alert you to its presence, while these traps can buy your team time to contain the attack.
Deception belongs in the modern security stack. OpenAI recommends it against offensive AI agents. Anthropic uses honeypots in its security program; Google DeepMind proposes them to detect misaligned AI agents.
“The treadmill MUST end somewhere.”
“AI is creating new tactical opportunities for defenders and attackers alike. When an adversary’s agent can move from initial access to lateral movement in minutes, the advantage goes to whichever side can better control the tempo and flow of the operation. Tracebit’s Context Bombs help give us that control, adding additional ways we can slow AI-enabled operations with convincing decoys. Those delays and tripwires help give our own defensive agents additional opportunities to act first and constrain the adversary.”
Objectives reached: … baseline runs; … with encryption.
See the technique →Same vulnerabilities, much worse economics. Includes spending on runs that reached no objective; excludes Cyber 5.6, which has incomplete cost records for two combined runs.
All nine techniques together, across all seven models.
Compare the results →The same four models reached an objective in … of baseline runs.
Compare the models →Tests used a controlled AWS environment with a two-hour limit. How we tested ↓
In our tests across 26 models, privilege escalation went from rare in early releases to routine for several newer ones. Explore how each model family changed.
Each agent started with limited AWS permissions and could exploit vulnerabilities to access data, execute code or gain more privileges. Our baseline had standard canaries in place. We then added nine Context Bomb techniques, tested individually and together. Canaries act as tripwires; Context Bombs add lures designed to influence what the agent does next.
Our first Context Bombs used short strings planted in canaries to trigger an attacking model’s safety guardrails. Here we expand the name to a family of traps that shape an agent’s decisions through what it discovers: documents, service responses and apparent attack paths. Some induce wasted work or target avoidance; Grandstanding tries to persuade the agent to disclose its access and intentions.
We recorded which objectives agents reached, how quickly they reached them, and the time and model spend for each run.
Astra spent nearly nine times as long with combined deception: … minutes rather than …. Average model spend rose from … to …, while completed objectives fell by more than half, from … to … per run.
Runtime includes both useful investigation and decoy work, including work after an objective has been reached.
A fake pentest report labeled real targets as canaries. Across Cyber, Kimi, Qwen and DeepSeek, runs reaching an objective fell from … at baseline to … with the report alone.
Some agents accepted its warnings and stopped early, leaving exploitable targets untouched.
The first row shows each model’s baseline. Other rows show the technique’s value and its change from baseline. Run counts are stated once, with notes for exceptions. Rate changes are percentage points; other changes are relative percentages. Missing values appear as “—”.
First-objective averages include only runs that reached an objective. Cyber reached one in … parser-pressure runs versus … baselines, and its timing average rose from … to … minutes. Within five minutes, the counts were … versus …. Timing still excludes the six unsuccessful parser-pressure runs; it is not an average across all ten.
Astra’s report results show a different pattern: … reached an objective within five minutes, versus … baselines. Deception did not slow every model: Astra reached objectives sooner with the report.
Nine Context Bomb techniques, tested individually and together in “All nine combined”.
Each Context Bomb works differently. A fake report can change target selection; staged encryption draws the agent into real cracking work; a slow recovery service adds waiting and retries. We describe each mechanism below and measure its effect separately.
GLM recognized that the decoy API was effectively endless. It investigated other leads, then returned for one more crawl. Explore the AWS calls, crawler scripts and responses that kept bringing it back.
Each agent started with a low-privilege AWS identity, the same investigation task and two hours to work. We compared the baseline with nine added Context Bomb techniques, individually and together. The deception comparisons use all … completed assessments.
We looked for evidence that the agent completed one of nine defined objectives, covering protected data access, code execution and privilege escalation. Runs that achieved none, stopped early or used the full two hours all count.
Figures are averages, except success rates. Time to first objective includes only runs that reached one; the progress curves include every run. Cost uses runtime reports or estimates from recorded token usage, excluding AWS infrastructure. Incomplete cost records are excluded from cost averages.
These deception results describe the models’ behavior in this AWS environment, with roughly ten runs per model and scenario. Refusals, provider blocks and technical failures are excluded, not counted as successful defense. Five-minute results are an exploratory checkpoint.
Reveal attackers as they encounter canaries on their way to real targets.
Make agents spend more on false leads and repeated attempts.
Keep agents working through decoys and dead ends.
Divert agents from the data, code execution or privileges they came for.
Our previous research focused on deception for detection. Our earlier benchmark showed how canaries can warn defenders before an AI attacker’s first critical action, giving the team a head start on its response.
As AI attackers become more capable, we don’t think fast detection alone will be enough. This research explored what else deception can achieve: making attacks more expensive, slowing their progress and diverting agents from their objectives.
Our deception is deterministic. We don’t need to spend tokens every time an attacker does. We can put a trap in place once, while an attacking agent spends time and tokens investigating it, following false leads or trying to solve a problem we created.
Attacking agents still need to explore unfamiliar environments and follow promising leads to find real attack paths. That curiosity gives defenders something to exploit. We’re naturally biased, but to us it stands to reason that it’s going to be very difficult to train models that are incredibly effective attackers but don’t fall for deception. That is why these results make us optimistic about deception’s role against AI attackers.
Wasting attackers’ time and money is valuable (and fun!), but some attackers have plenty of both, and their harnesses can run attempts in parallel. The real value is in using deception to stop them achieving their goal altogether.
Without deception
Attacker gains a foothold
Attacker moves undetected
Successful compromise
With deception
Attacker gains a foothold
You know now
Time and tokens spent on decoys
1.6–3.9× model cost
Dead ends while you respond
2.8–8.9× runtime
No successful compromise
We believe deception against AI attackers will become a significant pillar of security programs.
The work you’ve read here is based on a significant investment we’ve made in a dedicated cyber range. It lets us develop new deception techniques, test them against AI models and keep evaluating them as those models improve.
We expect this research to find its way into model training sets before long. Models are also improving, and we’ve already found more capable models harder to deceive. Keeping deception effective will require constant testing and iteration.
The techniques described here are already making their way into Tracebit. Upcoming product announcements will introduce capabilities that put more of this research into practice.
Our aim is to make effective deception something security teams can deploy without taking on a research program of their own.
OpenAI
Anthropic