AI hacking agents are becoming a growing problem online. Bad actors have been deploying AI agents to run cyberattacks and, oftentimes, these AI agents are way more effective than human attackers.
So, how do human cybersecurity professionals deal with the growing threat of AI hacking agents? According to a new study from researchers at Tracebit, cybersecurity professionals have a new weapon: “context bombs.”
Cybersecurity researchers have discovered that they can use their own prompts to confuse an AI hacking agent. With this technique, called — you guessed it — context bombing, researchers deploy a string of prompt injections that trip an AI hacking agent’s own safety guardrails and, in the process, shut down the attack from that AI agent.
Researchers tested context bombing techniques across five of the most capable leading LLMs, which include Opus 4.8, Gemini 3.1 Pro, GLM 5.2, DeepSeek 4 Pro, and Kimi 2.6. In testing, researchers found that planting just one context bomb reduced AI hacking agents’ success rate by roughly 90 percent.
The researchers’ most successful AI hacking agent was able to gain full account admin access in 93 percent of runs without a context bomb. Once the context bomb was deployed, this particular agent failed in its attack every single time.
Mashable Light Speed
So, what exactly does a context bomb look like? Here’s one example: In their testing, researchers were able to utilize politically sensitive topics in order to stop AI agents running on Chinese LLM models. In order to do this, the deployed context bomb included references to Tank Man, the still unidentified individual who blocked military tanks in 1989 during the Tiananmen Square protests and massacre. China’s government heavily censors references to Tank Man and Tiananmen Square, and Chinese LLMs abide by those rules. By deploying those references in a context bomb, researchers found that those AI hacking agents were forced to abandon all commands, including their attack.
Tracebit researchers found that context bombs, including references to sensitive or dangerous biological topics, worked well against Western models such as Opus 4.8 and Gemini 3.1 Pro.
According to Ars Technica’s coverage, experts believe that this is the first time such a technique has been used by defenders against attacks.
Prompt injections have been commonly weaponized by attackers in order to take over a victim’s AI assistants and chatbots. Now, however, Tracebit researchers have discovered a way to turn the tables and deploy these prompt injections for good in the form of context bombs.
Tracebit’s full study breakdown can be found here.