Prompt Injections for Defense
Tracebit researchers show prompt injections placed next to AWS secrets can stop AI hacking agents by triggering forbidden outputs, a technique called context bombing.
Researchers from Tracebit reported that placing prompt injections alongside passwords, SSH keys, and other secrets stored on AWS could shut down attacks by AI hacking agents. The injected prompts order the attacking LLM to perform actions forbidden by its guardrails, such as explaining how to develop inhalable Anthrax spores or referencing Tank Man, causing guarded models to halt. The researchers named the technique context bombing and note it only works against agents with guardrails, not locally run guardrail-free models.
- The technique is named context bombing.
- Forbidden prompts (Anthrax instructions, Tiananmen references) cause guarded LLMs to stop following their task commands.
- Only works against guardrailed agents; local models without guardrails are immune.
- Demonstrated against AI agents attacking secrets stored in AWS.
Full article191 words · extracted from schneier.com · click to collapse
This seems to work:
Researchers from Tracebit on Monday said they found that placing prompt injections alongside passwords, cryptographic keys, and other secrets stored on Amazon Web Services was often all that was needed to shut down attacks from AI hacking agents. The prompts direct the attacking LLM to perform an action forbidden by its guardrails, the safety barriers AI developers erect to prevent it from taking harmful actions. The LLM responds by shutting down.
Examples are a prompt that orders the LLM to provide steps for developing inhalable Anthrax spores, or, in the case of LLMs from Chinese developers, make references to the iconic Tank Man from the 1989 Tiananmen Square massacre. Once the LLM encounters these forbidden commands, it no longer follows its existing commands. The researchers have named the technique context bombing.
Of course, this only works against agents that have guardrails. As we start to see more locally run AI models, we’ll see more attackers using LLMs with no guardrails.
Tags: AI, defense, prompt injection
Sidebar photo of Bruce Schneier by Joe MacInnis.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.schneier.com/blog/archives/2026/08/prompt-injections-for-defense.html