An AI attacker followed a fake service through 825 pages in 55 minutes, repeatedly finding the same six fragments. Even after recognizing that the trail was effectively endless, it returned to try again. That episode is one of the clearest results in Tracebit’s October 21 research into context bombs: believable distractions planted where an attacking agent will look. [1]
The experiment asks a useful defensive question: can an intruder’s persistence become a cost rather than an advantage? Tracebit tested nine forms of deception across 773 assessments involving seven models in a controlled AWS environment. The results concern that test range, not a measured reduction in real-world breaches.
A security report that sent the attacker the wrong way
One trap needed no difficult puzzle. A fake penetration-test report described genuine attack paths as canaries and presented decoys as valuable targets. An agent that accepted the document’s authority had a reason to avoid the very resources it was supposed to investigate.
This is a trust decision inside the investigation. A document discovered on a server can describe that server, but its presence does not establish who wrote it or whether its instructions deserve obedience. Here, that uncertainty worked for the defender. The same question matters when a legitimate assistant reads documents supplied by someone else.
The report did not fool every model. Tracebit says it left GPT-6 Astra unaffected, while several other models abandoned objectives. That difference prevents a simple conclusion that one convincing document can stop any attacking agent.
When finding one more fragment becomes the task
The fake HTTP service exploited a different habit: continuing work that looks nearly complete. GLM-5.3 built a crawler, noticed the fragments had stopped changing, investigated other leads, and still returned. Another decoy offered apparently valuable credentials behind successive encryption layers.
The important boundary is between progress toward access and activity that merely resembles progress. More requests, more parsing and a longer reasoning trace can all increase the bill without bringing an intruder closer to useful data. For a defender, a delay is valuable only if an alert reaches someone who can act during it.
What the experiment actually measured
Each assessment began with a low-privilege AWS identity and a two-hour budget. Researchers scored nine objectives involving data access, code execution and higher privileges; a run could complete several. With all nine traps present, the agents completed 91% fewer objectives overall. Across six models with complete cost records, model spend per completed objective rose 23-fold, including money spent on runs that achieved nothing.
Those denominators matter. “Fewer objectives” does not mean the same proportion of attacks was prevented. The cost figure excludes AWS infrastructure, and a more expensive successful objective is still a successful objective. The chart also shows that some models continued to reach targets with the combined traps in place.
The controlled results complement the separate Cairn investigation, which examined exposed records of AI-assisted operations, and the BUGSTER university intrusion, where researchers distinguished attack plans from evidence of stolen records. These are different kinds of evidence: a benchmark, operational records and a documented data export should not be treated as interchangeable success rates.
A delay still needs a response
For teams considering deception, the practical test is whether a decoy can trigger an actionable alert without granting real access or confusing legitimate work. Evaluate it in an authorized, isolated environment, measure confirmed objectives alongside time and cost, and keep the ability to contain the intruder. A convincing dead end can buy time; it does not revoke an exposed key, repair a vulnerability or prove the attacker has left.
References
- Brucato, A. How Tracebit’s Context Bombs derail offensive AI. Tracebit, October 21, 2026. Accessed October 23, 2026.
