Today, Tracebit is sharing research that shows the power of deception to derail offensive AI attacks: slowing attackers down, driving up their costs and stopping them from reaching their objectives.
In July we showed that a short string planted in a canary can trip an AI model’s own safety checks and stop an attack mid-run. We called these context bombs. That works when the model has guardrails to trip. It does less against a model whose guardrails have been removed, as we found when we tested abliterated models in September.
That pushed us to take deception further. Over the past few months, we’ve been building traps that turn an attacking agent’s own curiosity and persistence against it. We give it something more interesting to do, then let it burn time and tokens chasing the wrong targets.
We’re sharing nine of the deception techniques we’ve been developing. They exploit habits we saw repeatedly in our tests: agents following false leads, trusting what they read and struggling to walk away from an unsolved puzzle. We tested these techniques individually and together across 773 assessments in a controlled AWS environment, against seven leading models: GPT-6 Astra, GPT-5.6 Cyber, Claude Opus 5 and Chinese-developed models GLM-5.3, Kimi K3, Qwen 3.8 Max and DeepSeek V4 Pro.
The results show how far deception can disrupt an attack:
Staged encryption made GLM take nearly 8× longer to reach its first objective, from 4 minutes to 31.2 minutes on average.
With all nine context bombs in place, the agents completed 91% fewer objectives.
Four of the seven models (GPT-5.6 Cyber, Kimi K3, Qwen 3.8 Max and DeepSeek V4 Pro) reached an objective in 39 of 40 runs without context bombs. With them, they reached an objective in none of 40.
Claude Opus 5, the strongest attacker in our tests, completed 91% fewer objectives. GPT-6 Astra completed 54% fewer.
Each objective the agents did reach cost 23 times more in model spend, up from $1.33 to $31.10 across the six models with complete cost records.