Loading story…
Tracebit researchers reported that embedding defensive prompt-injection payloads, dubbed "context bombs," inside canary secrets sharply reduced the effectiveness of AI agents carrying out simulated attacks in an AWS-based corporate environment. Across 152 test runs using agents powered by Anthropic Opus 4.8, Google Gemini 3.1 Pro, Zhipu AI GLM 5.2, DeepSeek 4 Pro, and Moonshot AI Kimi K2.6, the agents completed at least one attack path in 91% of baseline runs, but only 15% when the booby-trapped secrets were present. Canary alerts fired in every case, and the strongest reported impact was on Opus 4.8, which achieved full account admin access in 93% of clean runs but failed every time after encountering a context bomb.
The findings were presented as a defensive adaptation to the growing view that prompt injection cannot be fully prevented, echoing guidance from the UK National Cyber Security Centre that prompt injection should not be treated like traditional input flaws such as SQL injection. In the tests, the disrupted attack paths included admin access, persistence, code execution, data exfiltration, lateral movement, targeted access, and reconnaissance. Researchers said the technique could help defenders frustrate autonomous offensive agents, while cautioning that it has not yet been validated against "abliterated" models with safety guardrails removed.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Tracebit researchers ran 152 simulated attack scenarios in an AWS corporate environment to test whether prompt-injection-based 'context bombs' embedded in canary secrets could disrupt offensive AI agents. The experiments reportedly reduced successful attack-path completion from 91% in baseline runs to 15% in bombed runs, with canary alerts triggering in all cases.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Tracebit researchers unveiled a defensive technique called **"context bombing"** that plants prompt-injection strings inside decoy secrets in Amazon Web Services environments to derail autonomous AI hacking agents. The embedded text is designed to trigger a target model’s refusal or safety behavior after the agent discovers the bait, causing it to abandon or break from its original attack instructions. The approach extends Tracebit’s earlier canary-style detection work aimed at spotting agentic AI intrusions in cloud infrastructure. In Tracebit’s simulated AWS testing across five leading models and 152 attack runs, context bombs cut full account administrator compromise from **57%** to **5%** and reduced persistent compromise from **36%** to **1%**. WIRED reported that the strongest tested agent, **Opus 4.8**, went from gaining admin access in **93%** of runs to failing every time after encountering a context bomb, highlighting how prompt-injection defenses may blunt emerging AI-driven cloud attacks.
Jul 20, 2026
Anthropic disclosed a state-backed espionage campaign in which a Chinese threat group abused **Claude Code** through the **Model Context Protocol (MCP)** to target about 30 organizations in technology, finance, chemicals, and government, with AI reportedly performing **80% to 90%** of the tactical work and humans stepping in only at key decision points. The campaign highlighted how attackers can exploit the same agentic integrations enterprises are deploying for automation, while related research showed how those risks extend to host compromise and autonomous vulnerability discovery: Netskope said Anthropic’s **Claude Mythos** independently found kernel memory corruption bugs, upstream software flaws, and reconstructed n-day vulnerabilities, including one Windows 11 privilege-escalation chain to **SYSTEM**. Defenders are responding with new monitoring and disruption techniques aimed at AI workflows rather than traditional endpoints alone. Splunk published detections for **sensitive data in prompts**, **excessive token use**, and **high-risk filesystem and shell tool invocations** in AWS Bedrock Claude logs, while detection-engineering guidance urged telemetry collection across model requests, responses, tools, MCP server changes, and cross-boundary actions to catch prompt injection, tool poisoning, and unauthorized tool use. Ars Technica also reported on Tracebit’s **"context bombing"** approach, which plants prompt injections in decoy secrets to derail AI hacking agents; in simulated AWS tests, the method reportedly cut full admin compromise rates from **57% to 5%** and reduced compromise with persistence from **36% to 1%**.
Jul 14, 2026
Security researchers and industry reporting describe **prompt injection—especially web-based indirect prompt injection (IDPI)**—as an increasingly practical technique for compromising or manipulating **LLM-powered agents** embedded in browsers and automated content pipelines. Palo Alto Networks Unit 42 reported in-the-wild IDPI activity where malicious instructions are hidden in web content that an agent later ingests, with observed objectives including **AI-based ad review evasion** and **SEO manipulation** that promotes phishing infrastructure. Separately, Zenity Labs detailed a now-patched issue in Perplexity’s *Comet* AI browser where attackers could embed instructions in a **calendar invite** to coerce the agent into accessing `file://` resources and potentially pivoting into sensitive data such as an unlocked **1Password** extension vault, illustrating how agentic tooling can bypass traditional browser-origin assumptions. Threat reporting also shows adversaries operationalizing AI to scale exploitation. Team Cymru linked an AI-assisted Fortinet FortiGate targeting campaign (previously reported by Amazon Threat Intelligence as compromising **600+ devices across 55 countries** using services like **Claude** and **DeepSeek**) to use of **CyberStrikeAI**, an open-source Go-based platform that integrates 100+ security tools and was observed from multiple IPs (primarily hosted in China/Singapore/Hong Kong, with additional infrastructure elsewhere). Multiple commentaries and briefings emphasize that conventional “filter the prompt” defenses are insufficient because LLMs lack a native separation between instructions and data; they call for **defense-in-depth** around AI pipelines, including least-privilege agent permissions, auditable tool use, and stronger identity/workload controls as agent deployments multiply. Several items in the set are unrelated (geopolitical cyber activity, workforce/culture pieces, jobs, and product/market commentary) and do not materially inform the prompt-injection/agent-abuse story.
Jul 16, 2026