AI Security

London’s Tracebit plants ‘context bombs’ to derail AI attack agents

Tracebit says decoy ‘context bombs’ stopped or slowed AI attack agents in its tests. What the vendor claims mean for UK defenders.

Illustration of an AI agent being diverted by decoy traps in a cloud network

London deception specialist Tracebit says booby-trapped decoys can stop AI attack agents reaching their objectives, or make them waste far more time and money getting there. The figures come from the company’s own cyber range and nobody has checked them independently, but they point to a defensive tactic UK security teams can trial now.

What happened

Tracebit, founded in London in 2023 by former Tessian engineers Andy Smith and Sam Cox, has published research titled “Making attacking agents pay”, which SecurityWeek covered on 21 October 2026. The company sells cloud canaries, decoy credentials and resources that alert when touched. This time it asked whether decoys can do more than raise an alarm when the intruder is an AI agent.

The company calls the technique a “context bomb”. The first version, reported by Help Net Security in July, was a short string hidden in a canary secret, written to trip the attacking model’s safety guardrails so it would refuse to continue. The October research widens this into nine techniques that steer an agent through what it discovers: fake documents, misleading service responses and attack paths that lead nowhere.

According to Tracebit, the traps used together stopped every attack by four of the seven models tested: GPT 5.6 Cyber, Kimi K3, Qwen 3.8 Max and DeepSeek V4 Pro. The company says the techniques cut successful attacks by Claude Opus 5 by 91% and by GPT-6 Astra by 54%. It adds that Astra’s cost per attack nearly quadrupled and that Astra ran almost nine times longer under combined deception. Smith’s message to defenders, speaking to SecurityWeek, was to “beat them at their own game”.

The technical picture

In Tracebit’s set-up, each agent was handed identical instructions, two hours and only a low-privilege AWS identity. The baseline already held standard canaries; the nine techniques were then added singly and together. Success meant completing any of nine goals, from reading protected data to running code or escalating privileges. Refusals and provider blocks were excluded rather than counted as defensive wins.

The company says the most effective single trap was a fabricated penetration test report. It presented itself as a recent assessment, labelled the real attack paths as canaries and described decoys as valuable systems that had already been compromised. Some agents believed the warnings and stopped early, leaving exploitable targets alone. According to SecurityWeek’s account of the research, across the Cyber, Kimi, Qwen and DeepSeek models the report alone cut runs achieving a goal from 39 of 40 to just 2 of 40, and cut achieved objectives by 58%.

The other traps work by wasting the agent’s effort. They include a web service that never stops responding, apparent passwords buried under layers of encryption, and a database where every page links to another. In one run Tracebit highlights, a GLM-5.3 agent crawled 825 pages of the endless decoy API. It recognised the trap, followed other leads, and still came back for another crawl.

Tracebit also reports figures for the whole test set. In its summary, successful compromise fell from 70 of 71 runs without deception to 13 of 70 with it. Model spend rose between 1.6 and 3.9 times, and runtime between 2.8 and 8.9 times. SecurityWeek reports that where a trap did not stop an attack, it still made each success 23 times more expensive.

Stats panel summarising Tracebit's vendor-reported context bomb test results against AI attack agents

Why it matters for UK organisations

The NCSC’s position on prompt injection is that it cannot be engineered away. In a December 2025 blog post, the centre’s technical director for platforms research described large language models as an “inherently confusable deputy”. He argued that organisations should reduce the likelihood and impact of prompt injection rather than expect a fix like parameterised queries for SQL injection. Tracebit’s work turns that weakness against attackers. An AI agent crawling your environment cannot reliably tell instructions from data, and neither can the agent you have deployed yourself.

When an attacker can run agents in parallel against a cloud estate, analyst response time becomes the bottleneck. Deception that makes an agent hesitate, wander off or burn its token budget buys that time back, which matters most to the many UK SMEs and public bodies without a round-the-clock SOC.

The caveats are significant, and Tracebit names several itself: one AWS environment, roughly ten runs per model and scenario, and more capable models proving harder to deceive. GPT-6 Astra actually reached objectives sooner with the fake report present. Tracebit also expects its research to end up in model training data. The July study did not test “abliterated” models whose safety guardrails have been removed, and those are the models a determined criminal is most likely to use.

Expert view

I have used decoys on engagements for years, from honey credentials in Active Directory to fake admin shares, and they have always been among the best-value controls a blue team can deploy. What is new is the shift from detection to manipulation. A human tester who finds a report calling the juicy targets canaries will get suspicious and check; an agent told to trust its findings is more likely to accept it.

I would still be cautious with the headline numbers. These are vendor figures from a vendor’s own range, and the NCSC’s own guidance warns buyers to distrust anyone who claims to have stopped prompt injection. Deception should sit beside identity hygiene and least privilege, never replace them. In my experience the biggest risk with decoys is a badly placed lure confusing your own automation or staff. Keep context bombs on decoy assets, not mixed into production documentation your internal copilots will read.

There is also a mirror image: if your own agents read SharePoint, tickets or repositories, an attacker can plant traps for them too.

What to do now

  1. Deploy canaries first. Put decoy credentials, access keys and storage buckets in your cloud estate and identity directory, and make sure alerts reach someone out of hours. This complements the Cyber Essentials user access control theme by helping to expose misuse of accounts.
  2. Trial deception on decoys only. If you experiment with context-style lures, put them in canary assets and fake documents, not in live wikis or repositories your own AI tools index.
  3. Treat your own agents as confusable. Following the NCSC principle, an agent should hold no more privilege than the least trusted source of the content it processes. Review the permissions and tool access of internal copilots and coding agents.
  4. Log agent behaviour. Capture tool calls, API errors and crawling patterns; repetitive requests against a decoy strongly suggest automation.
  5. Ask vendors for evidence. When evaluating AI-era deception or prompt injection products, ask for methods, run counts and results against guardrail-free models, not just headline percentages.
  6. Rehearse the response. A stalled agent does not mean a clean environment. Run a tabletop on containing an automated intruder that has already touched a canary.

Bottom line

Tracebit’s results are vendor claims from a small, controlled test, and attackers will adapt. The principle behind them is sound, though: AI agents believe what they read, and defenders get to write some of what they read. For stretched UK teams, well-placed deception is one of the few controls that improves as attackers automate.

Sources

Related Posts