Prompt injection is being turned back on attacking agents

Tracebit, according to Ars Technica, has described “context bombing”: defenders place text near sensitive AWS secrets that triggers a safety refusal in an attacking LLM agent. Across five models and 152 attack runs, admin takeover fell from 57% to 5%, and full compromise with persistence fell from 36% to 1%.

Defenders are using prompt injection as a trap

Prompt injection has mostly been an attacker’s tool. A hidden instruction in an email, calendar invite or document can make a model ignore its original task, leak data or take a harmful action.

Tracebit turns the same mechanism against agents exploring a cloud environment. It plants instructions in decoy secrets that push the model toward forbidden content. Once the agent reads them, its guardrails often push it into refusing to continue.

Agentic attacks are decided in minutes, not dashboards

The timing explains the appeal. Tracebit previously used AWS canary resources that detected an attacker in an average of 8 minutes. In the experiments, agents needed an average of 14 minutes to escalate to admin control. A 6 minute response window is thin.

Context bombing is meant to be a brake, not just an alarm. Ars reports that runs achieving any attack path fell from 91% to 15%, and the average number of completed paths fell from 1.53 to 0.16. No run completed an attack path without triggering canary detection.

A simulated AWS lab is not a production incident

The technique’s strength is also its weakness: it depends on the behavior of specific models and their safety policies. Tracebit tested Opus 4.8, Gemini 3.1 Pro, GLM 5.2, DeepSeek 4 Pro and Kimi 2.6 in a simulated AWS environment. That does not prove the trap will survive a different agent, system prompt or attacker who routes around guardrails.

It may also become a race over context handling. An attacker can tell an agent to ignore suspicious strings, filter secrets before adding them to context, or use models with a different refusal profile.

The next test is whether this is defense or benchmark magic

The useful signal will be independent replication outside Tracebit’s setup and outside the model set used in the original test. If context bombing works across agents, cloud scenarios and realistic playbooks, it could add an active brake to canary-style detection.

If it does not, it still makes one point hard to ignore: prompt injection is not only an application bug. It is a property of systems where text, permissions and actions meet inside the same context window.

Lilith's verdict

The defender is not waiting by the alarm. They hide bait in the vault with a line the attacking agent reads before shutting the door on itself.