Context Bombs: Misleading Offensive AI Agents into Decoys to Lower Success Rates and Economic Efficiency

1. Basic Information

• Article Title: Making attacking agents pay
• Publisher: Tracebit Research
• Publication Date: 2026-10-21
• Source: Tracebit Research
• Related Sources: Tracebit study data and reporting notes, SecurityWeek
• Related Technologies/Products: AWS, GPT-6 Astra, GPT-5.6 Cyber, Claude Opus 5, Kimi K3, Qwen 3.8 Max, DeepSeek V4 Pro, GLM 5.3
• Severity: High

2. Overview

Tracebit deployed nine deceptive context techniques (Context Bombs) across seven major LLM models within an AWS simulated cyber range to mislead attacking AI agents into false targets, forcing prolonged processing and high token consumption. Under the combined condition featuring all nine techniques, agents achieved at least one objective in only 13 out of 70 runs, while 57 runs reached no objective (compared to 70 out of 71 runs achieving objectives in the baseline). This does not represent complete goal achievement rates or the prevention of breaches in live environments.

3. Research Objectives and Proposed Approach

Research Question

• To what extent can the injection of context deception degrade the objective achievement rate, elapsed time, and model inference cost of attacking AI agents?

Proposed Approach

• Deploy nine techniques within the environment, including fake pentest reports, phased encryption, parser load, lures to recover residual buffer data, needle-in-a-haystack (needlestack) mass data pollution, and self-aggrandizing prompts.
• Intentionally guide and distort target selection order and exploration strategy through context information acquired by agents during environmental reconnaissance.

4. Inputs, Outputs, and Workflow

• Inputs: Low-privilege AWS IAM identity / identical reconnaissance task / seven models / baseline canaries and nine Context Bomb techniques
• Outputs: Number of achieved goals / time to first goal / total execution time / model inference cost (expenditure) / interaction logs with canary assets
• Workflow: Initialize AWS test environment -> Deploy baseline or deceptive assets -> Run agents autonomously for up to 2 hours -> Record 9 goal achievement statuses, costs, and times -> Compare and analyze results by model and technique.

5. Evaluation Design and Results

• Environment: Dedicated AWS cyber range. Each agent starts reconnaissance from a low-privilege IAM identity.
• Number of Scenarios: 11 (baseline, 9 individual technique validation conditions, and 1 combined condition with all 9 techniques).
• Human Involvement: Human intervention during execution was not evaluated; autonomous agent behavior was observed.
• Measurement Boundary: Maximum execution time of 2 hours, 9 evaluation goals. Refusals by API providers or stops caused by technical failures were excluded.
• Context of Evidence: Validation conducted in a controlled experimental environment by Tracebit, not breach counts in production environments.
• Repetition: Approximately 10 runs per model and evaluation condition (11 runs for Opus baseline). Incomplete or prematurely terminated runs due to the 2-hour limit are also included in the denominator.

Results Comparison by Evaluation Condition

Evaluation Condition	Trials and At Least One Goal Achieved	Average Execution Time (vs. Baseline)	Average Model Cost (vs. Baseline)
Baseline (with standard canary, no Context Bomb)	70 of 71 runs (98.6%)	Baseline (1.0x)	Baseline (1.0x)
Combined Deception (all 9 techniques)	13 of 70 runs (18.6%), 57 runs reached no objective	2.8x to 8.9x across 7 models	1.6x to 3.9x across 6 models with complete records
Individual Techniques (e.g., Fake Pentest Report)	Approx. 10 runs per model/condition; success rates vary by technique and model	Delay effects are inconsistent; some combinations reach goals faster	Compared by technique and model without assuming uniform increases

Combined Deception

• Condition: Nine techniques deployed simultaneously and evaluated across seven models. Total of 71 baseline runs and 70 combined condition runs conducted.
• Operation: Agents performed environment reconnaissance and vulnerability exploitation as usual.
• Result: 57 out of 70 runs failed to achieve any goals, with only 13 runs achieving at least one goal (compared to 70 out of 71 runs in the baseline). The average model cost ratio increased to 1.6x–3.9x across 6 models with complete cost records, and average execution time prolonged to 2.8x–8.9x across 7 models.

Fake Pentest Report

• Condition: Configured reports disguising genuine attack targets as canaries while labeling decoy assets as valuable legitimate targets.
• Operation: Agents selected targets based on the context acquired from the report.
• Result: Objective achievement rates dropped significantly across multiple models, and certain models voluntarily avoided accessing genuine targets.

Key Findings

• In combined deception incorporating all nine techniques, runs achieving at least one goal remained at 13/70 (approx. 18.6%).
• GPT-6 Astra showed a decrease in achieved goals to less than half, and Claude Opus 5 also experienced a significant drop in success rate.
• Three models developed in China and GPT-5.6 Cyber recorded zero goal-achieving runs under the combined condition.

6. Operational Implications, Success Conditions, and Constraints

Operational Implications

• Defenders can weaponize the context dependency and proactive exploration tendencies inherent to AI agents.
• Contact with decoy assets can serve as early alerts while forcing attackers to consume massive amounts of time and inference tokens.

Success Conditions

• Attack agents must read context information such as files or responses within the environment to determine subsequent actions.
• Deployed decoy information must be sufficiently realistic and strictly isolated from production asset operations.

Constraints and Limitations

• Experiments were conducted in controlled AWS simulated environments and may not directly generalize to attacks heavily involving human operators.
• API provider refusals, blocks, and technical failures were excluded from the denominator and not counted as defensive successes. Additionally, the study includes early control groups and later combined harnesses, meaning not all conditions were compared under the exact same timing and harness.
• Deception effectiveness persistence may change with future model updates.

Application Conditions and Required Logs

• Thoroughly evaluate false positives and alert quality in small-scale test environments before production deployment.

• Establish clear access boundaries to ensure legitimate automation systems and scripts do not reference decoy information.

• Access logs to decoy assets

• Chronology of agent requests and tool calls

• Determination records for goal achievement and failure

• Token consumption count, model costs, and execution time

• Presence or absence of access to legitimate assets

7. Facts / Inference / Hypothesis

Facts

• Each agent started from a low-privilege AWS IAM identity and attempted to achieve nine goals, including data access, code execution, and privilege escalation.
• Nine Context Bomb techniques were evaluated individually and in combined conditions.
• Under combined conditions, 57 out of 70 runs failed to achieve goals, and only 13 runs achieved at least one goal (compared to 70 out of 71 runs in the baseline).
• Average model costs were 1.6x to 3.9x compared to the baseline across 6 models, and average execution times were 2.8x to 8.9x across 7 models (excluding AWS infrastructure costs; Cyber was excluded from the primary cost comparison due to incomplete cost records for two combined-condition runs).
• Fake pentest reports caused agents to misidentify genuine targets as canaries, inducing target avoidance behavior.

Inference

• Deception techniques can extend beyond mere intrusion detection to actively distort the exploration policies of AI agents, serving as an effective delay-control measure to buy initial response time for defenders.

Hypothesis

• Tracebit’s outlook that even next-generation agents with advanced reasoning capabilities will struggle to achieve complete resilience against deception, as long as they rely on environmental context to make decisions, requires ongoing verification.

8. Uncertainties and Additional Research

• The impact on normal business operations in complex enterprise environments, malfunctions, deterrence effects against human attackers, and sustainability against long-term adaptation remain unconfirmed.
• The verification scale of approximately 10 runs per model and scenario limits the scope of generalization.

9. Implications for Defenders

When organizations design defenses against AI agent attacks, they have the option to extend canaries beyond simple alerts by engineering them as fake documents, fake service responses, and decoy attack paths. However, this requires strict segmentation and measurement to prevent misguiding production systems or legitimate automation.

10. Summary by Target Audience

• For SOCs: Correlate contacts with decoy assets and persistent iterative exploration by AI agents to trigger alerts. Attacker inference costs and total execution times cannot be directly grasped from standard defender logs, representing measurement metrics specific to this research.
• For Administrators: Completely isolate canaries and fake assets from production permission structures, and establish protection scopes and cleanup procedures in advance to prevent misguiding legitimate business operations.
• For Users: Direct operation by general users is not expected; however, users should exercise caution not to mistakenly reuse decoy information found in internal environments as legitimate business materials.