AI Falls Into Its Own Trap

Article by Nacata Security, 27/07/2026

Did you know that an AI can be defeated using its own internal rules?

Tracebit has discovered how to stop attacking AI agents dead in their tracks.

Prompt injection has been a real threat for two years: hidden instructions embedded in emails or web pages cause an AI to obey the intruder.

What no one expected is that this same logic could be turned against the attacker, using the model’s own restrictions as an active and effective defensive weapon.

Tracebit has demonstrated this with very concrete and revealing figures.

The firm placed text fragments designed to trigger the attacking model’s internal rejection mechanisms alongside fake credentials known as canaries. When the AI executing the attack reads that content, its safeguards fire and the attack grinds to a halt. The researchers call this context bombing: flooding the model’s context with material it refuses to process.

Once inside the context, the model does not recover.

Andy Smith, co-founder and CEO of Tracebit, explained it clearly: the rejection mechanism has a strong effect that agents struggle to recover from. It is not a momentary block; the model continues to reject any subsequent instruction. They tested the technique against five advanced models in a simulated Amazon Web Services environment, using routine tasks that ultimately led the agents to encounter the trap credentials.

The most dangerous model went from a 93% success rate to zero.

Without context bombing, that model gained administrator access in 9 out of every 10 attempts. With the trap activated, it failed in all 152 recorded attempts, without exception. It is the kind of result that rarely appears in cybersecurity and that makes this technique something deserving of immediate attention.

The trap must be tailored to each model.

Not all models are blocked by the same content. For Western models, such as those from Anthropic or Google, references to biological weapons proved effective. For models developed in China, the key was mentioning the Tiananmen man, a topic completely banned by censorship.

A tactical advantage, not a definitive solution.

Context bombing does not eliminate the problem at its root. Prompt injection remains possible because no model resolves the confusion between instruction and data within its context. What this technique does offer is time: in earlier Tracebit tests, canaries issued alerts eight minutes in advance, but the attacker completed access in fourteen. Context bombing turns that race into a dead stop.

Political restrictions are harder to remove than technical ones.

A developer can retrain a model to be less strict about a specific security-related question. But political or regulatory restrictions are not a patchable flaw: they are deliberate design decisions. That makes them a stable foothold for those developing defenses, because the attacker cannot easily remove them either.

The hardest weakness to fix becomes a shield.

What for years was considered an inconvenient limitation of large language models — their forbidden zones — turns out to be their most useful feature for defense. The more rigid the restriction, the more effective the bombing.

The AI battlefield has just changed.

Until now, defenders reacted after the attack or, at best, issued early warnings. Context bombing proposes something different: intervening in the attacking agent’s own reasoning before it completes its objective. It is an inversion of prompt injection that turns the model into its own obstacle.

The attacking AI, defeated by itself.

The question now is whether attackers will find models without those restrictions, or whether the race between attack and defense in AI has just changed forever.

Are you prepared for the next threat to arrive powered by artificial intelligence?

Security is not improvised, it is audited. At Nacata Security we detect vulnerabilities and protect your company, because a single flaw can cost you everything you have built.

Related articles

Nacata Security, reach out to us anytime