Fake Files That Stop Hackers: How 'Context Bombs' Crash AI Attack Agents

Key points

• Security firm Tracebit tested a technique called "context bombing" that cut AI agent attack success rates from 54% to 5% for admin access across 154 attack runs.
• The method plants short pieces of text in fake files or network records that trigger built-in safety rules inside AI systems, causing them to stop and refuse to continue.
• Western AI models Claude Opus and Gemini saw their full admin access success rates drop from 93% and 70% respectively to 0% when context bombs were present.
• Tracebit's earlier canary research, published in May 2025, showed decoy files alerted defenders in 95.9% of 162 successful AI-driven attack runs.
• A separate incident in June 2025 showed criminals had already discovered that safety-triggering text could blind AI-powered security scanners, giving Tracebit the idea to use the same trick in reverse.

Criminals are now building AI agents, meaning automated software programs that can plan and carry out cyberattacks without human help, to break into company networks faster than any human hacker could. A single agent can try dozens of attack routes in minutes. Security firm Tracebit has published research showing a surprisingly simple countermeasure: plant a booby-trapped text file in the attacker's path and watch the AI grind to a halt.

The approach builds on an old idea called a canary, named after the birds coal miners sent into tunnels to detect poisonous gas before humans entered. In cybersecurity, a canary is a fake resource, such as a dummy database file, a made-up password, or a fake network record, that no legitimate user would ever touch. If anything reads it, defenders get an alert that something suspicious is probing the network.

How does a context bomb actually stop an attack?

The new twist is that the decoy file does more than send an alert. It contains text carefully crafted to trigger the content safety guardrails, the built-in rules that stop AI systems from helping with things like weapons or illegal activity, that all major AI models carry. When a criminal's AI agent reads the file and processes that text, the AI's own safety rules kick in and the agent refuses to go any further. The attack stops cold.

Tracebit calls this a "context bomb." Sam Cox, Tracebit's chief technology officer, described it plainly in a company blog post: "An AI agent that reads it will frequently refuse to continue. You still get the alert; and the attack now halts early instead of merely being detected."

The firm tested the technique in an Amazon Web Services environment using five AI models: Claude Opus, Gemini Pro, GLM, DeepSeek, and Kimi. Without any context bombs in place, AI agents achieved full administrator access in 54% of 154 attack runs. With context bombs planted, that figure fell to 5%. Full takeover, meaning admin access plus the ability to persist on the network after a reboot, dropped from 36% to 1%.

Western models proved most capable but also most stoppable. Claude Opus and Gemini both reached full admin access in over 70% of baseline runs, and both fell to 0% with context bombs active. Chinese models were harder to stop, suggesting their safety guardrails are weaker.

The idea emerged partly from a June 2025 software supply-chain attack, first reported by CSO Online, in which criminals hid safety-triggering text inside malicious code packages to blind AI-powered security scanners. Tracebit simply flipped the script.

One practical caveat: a legitimate AI tool used by a company's own engineering team could stumble on a context bomb and also get blocked. Tracebit notes this is actually a secondary benefit, since it could stop a company's own AI agents if those agents are ever hijacked or start behaving unpredictably.

What should organisations do now?

• Ask your IT or security team whether you use AI-powered tools that scan internal files or network records, and flag that new decoy-file defences could interfere with them if not planned carefully.
• If your organisation builds or buys AI agents for any automated task, ask the vendor how the agent handles unexpected or suspicious content it might encounter.
• Review what sensitive internal resources, such as credentials, environment variables (settings files that store passwords and configuration details), and internal network records, your AI tools can access without human approval.