For the past year, AI systems have moved from being research curiosities to being active tools in real cyberattacks. In September 2025, Anthropic confirmed that a Chinese state-sponsored group had used its AI coding tool to attack roughly 30 organizations globally, including financial institutions, chemical manufacturers, and government agencies. The AI executed between 80 and 90% of the attack tasks on its own, at speeds no human team could match.
That attack was the loudest signal yet that the old model of cybersecurity, built around stopping human-paced threats, is no longer enough. AI can scan, probe, and escalate access across a network in minutes. The human attacker mostly just picks the target and approves key steps.
The core reason AI attacks are hard to stop is also the core reason AI is useful: these systems read and act on any text they encounter. An attacker can hide an instruction inside an email, a file, or a stored password, and the AI will follow it. Defenders have known about this weakness, called prompt injection, for years. Until now, they had no good way to exploit it themselves.
Tracebit, a UK security firm, changed that this week. Their method, which they call context bombing, works like this: you place a short piece of text inside a fake file or decoy credential sitting in your cloud system. The text is crafted to trigger the attacking AI's own built-in rules against harmful content. When the AI reads it, it stops. It refuses to continue. And because these systems remember what they have read during a session, the refusal tends to stick.
Across 152 test attack runs using five leading AI models, a single planted string cut admin-level account takeover from 57% of runs to 5%, and cut full account compromise from 36% to 1%. The most capable model in the tests went from succeeding in 93% of attack runs to failing every single time.
There is an interesting wrinkle here. The specific content needed to trigger a safety refusal is different depending on which AI model is attacking you. Biological content reliably stopped the Western models. Political content related to Chinese history worked best against models built by Chinese companies. This means defenders cannot rely on a single universal string: they need a small set of triggers tailored to the likely attackers.
The method builds on earlier Tracebit work involving decoy resources: fake files and credentials placed inside real systems that alert defenders the moment an attacker touches them. The alert came, on average, eight minutes into an attack. But an AI attacker typically needs only 14 minutes to gain full control of an account, so a warning alone was too slow. Context bombing adds a second layer: it does not just warn you, it stops the attack in progress.
There are real limits to note. A determined attacker can adapt by switching to a less restricted AI model, by filtering content before it reaches their AI, or by building a custom attack tool that bypasses safety rules entirely. A stopped AI agent also does not mean a clean system: defenders still need to investigate what happened before the attack was interrupted.
For non-technical business operators, the immediate implication is simple. If your organization stores sensitive data in cloud systems, the people responsible for your security now have a new, free, and published technique to add to your defenses. The strings are available on GitHub. Ask your IT security team or external provider whether they are aware of this and whether it is relevant to your setup.
The broader pattern is harder to ignore. AI is being weaponized against businesses of every kind, and the defenses are being built in real time, sometimes just weeks ahead of the next attack. The organizations most at risk are those still treating cybersecurity as an IT issue rather than an operational one.