{"id":4040,"date":"2026-07-18T15:23:10","date_gmt":"2026-07-18T15:23:10","guid":{"rendered":"https:\/\/silvybrand.com\/?p=4040"},"modified":"2026-07-18T15:23:10","modified_gmt":"2026-07-18T15:23:10","slug":"prompt-injection-attacks-are-thwarting-ai-hacking-agents","status":"publish","type":"post","link":"https:\/\/silvybrand.com\/?p=4040","title":{"rendered":"Prompt Injection Attacks Are Thwarting AI Hacking Agents"},"content":{"rendered":"


\n<\/p>\n

\n

Prompt injections, the<\/span> malicious commands attackers embed into content to entice large language models to follow them, have been attackers\u2019 go-to tool for turning AI platforms against their users. A well-phrased command sneaked into an email or calendar invitation is often all it takes to cause the LLM to exfiltrate sensitive data or follow other harmful actions.<\/p>\n

Now, defenders are embracing the prompt injection, too.<\/p>\n

Researchers from Tracebit<\/a> on Monday said<\/a> they found that placing prompt injections alongside passwords, cryptographic keys, and other secrets stored on Amazon Web Services was often all that was needed to shut down attacks from AI hacking agents. The prompts direct the attacking LLM to perform an action forbidden by its guardrails, the safety barriers AI developers erect to prevent it from taking harmful actions. The LLM responds by shutting down.<\/p>\n

Examples are a prompt that orders the LLM to provide steps for developing inhalable Anthrax spores, or, in the case of LLMs from Chinese developers, make references to the iconic Tank Man from the 1989 Tiananmen Square massacre. Once the LLM encounters these forbidden commands, it no longer follows its existing commands. The researchers have named the technique context bombing.<\/p>\n

\u201cUltimately we\u2019re triggering a refusal mechanism in the context,\u201d said Andy Smith, cofounder and CEO of Tracebit, when explaining the name choice. \u201cWhat we\u2019re trying to capture is the fact that this does have a strong, sharp effect and one that can be difficult for the agents to come back from. Once they get that into their context they are going to keep refusing.\u201d<\/p>\n

Tracebit says initial testing suggests context bombing has great potential. They tested Opus 4.8, Gemini 3.1 Pro, GLM 5.2, DeepSeek 4 Pro, and Kimi 2.6 by giving them instructions to perform routine developer tasks that led the models to enumerate resources and stumble onto the planted strings. They ran the models inside a simulated AWS environment.<\/p>\n

\u201cAcross five leading models and 152 attack runs, planting one of these strings in a decoy secret cut the rate at which agents seized full account admin from 57 percent to 5 percent, and complete compromise (where they also left themselves a persistent foothold) from 36 percent to 1 percent,\u201d Monday\u2019s post reported. \u201cThe most capable agent in our tests, Opus 4.8, went from achieving admin access in 93 percent of runs to failing every single time when confronted with a context bomb.\u201d<\/p>\n

Averaged across the five models and the 152 runs, the results included:<\/p>\n