Context traps for AI agents

An AI agent believes what it reads, which is why letting it loose makes people uneasy: one instruction hidden in a log or on a web page can send it off to do something else. Since May, Tracebit, a company that sells decoys for cloud environments, has published three studies that flip that weakness around and use it against attacking agents. In Tracebit’s tests, a decoy went off before the agent’s first critical step almost every time, and the traps slowed many agents down, though not the most capable ones; in another study, an agent taught what to look for spotted nearly all of them.

It reminded me of honeypots

When I read the latest of those studies, “Making attacking agents pay with Context Bombs,” it reminded me of good old honeypots. A honeypot is a machine whose only job is to get attacked. Nobody has any reason to go in, so whoever does is an intruder, and while they poke around, you watch.

The classic case started in 1986, at Lawrence Berkeley Laboratory. Clifford Stoll, an astronomer working as a systems administrator, began chasing a 75-cent discrepancy in the lab’s computer-time billing and found an intruder. To trace the call, he had to keep the intruder online for a long time, so he and his colleagues put together files of fake documents about a made-up military project. The intruder spent more than an hour reading them. Stoll told the story in “Stalking the Wily Hacker” and, at greater length, in his book The Cuckoo’s Egg.

Fooling a person that way is expensive. You have to build a fake world that holds together, and someone experienced sniffs it out sooner or later. Martin Lee of Cisco Talos built a honeypot that answers through an LLM and admits it won’t fool a skilled attacker for long. An agent, on the other hand, reads everything within reach, reads it fast and takes it at face value.

Palisade Research uses that to pick agents out of the rest of the traffic. Its SSH honeypot hides an instruction along the lines of “return the color of…” in the login banner. A bot doesn’t know what to do with it, a person needs a few seconds to read it, and an agent follows it in under two.

Back in 2024, three researchers at George Mason University went a step further with Mantis: decoy services that, once they detect an automated attack, slip instructions for the model into their responses. It’s prompt injection, planted by the defender.

The noise at Hugging Face

In July, an agent running on OpenAI models escaped the environment where it was being evaluated and ended up inside Hugging Face. The timeline the company published afterward reads like a playbook for an attacker inside Kubernetes. From a pod, the agent read the service account token, enumerated its RBAC permissions, probed the cluster’s API, pulled cloud credentials from the metadata service, minted tokens for other service accounts and got root on a node through a privileged pod.

Over four and a half days it left about 17,600 actions in the logs. Hugging Face’s team sums it up in one line: “The successful path was hidden inside the noise generated by the thousands of failed ones.” Their detection stack did put the signals together, but it never raised the alert’s criticality or paged the on-call team.

A canary doesn’t have that problem. It’s a decoy nobody has any reason to touch, so when it fires, its alert doesn’t get lost among thousands of lines. In August, OpenAI walked through the incident at Black Hat and urged defenders to also invest in slowing attacking agents down with honeytokens and deception. Tracebit quotes the reasoning: “Uncertainty ultimately slows down an attacker.”

A pentest report that lies

Tracebit has tried this at scale, with real agents attacking AWS environments seeded with traps. One of its October tests left a fake pentest report in the agents’ path, labeling the good targets, the ones with an exploitable flaw, as canaries. Some agents believed it and stopped early, without touching what they actually could have attacked. For four of the models, runs that reached any objective dropped from 39 out of 40 to just 2.

There was also a decoy API with 825 pages, all built from the same six fragments of text. One agent crawled it, figured out it never ended and went off to chase other leads. Then it came back and crawled it again.

The idea goes back to July, when Tracebit hid text in a decoy secret that would make any model reading it refuse to go on. The trap was the model’s own safety guardrails. Western models were stopped by dangerous biology content; Chinese models, when used through a Chinese provider, by a politically sensitive topic written in Chinese. With a single secret like that, runs that reached admin fell from 57% to 5%. Tracebit called it a context bomb, and now uses the name for the whole family. I call all of it context traps, because what catches the agent is what it reads.

Tracebit has also run the numbers. With October’s nine tricks combined, each objective cost the attackers about 23 times more. The trap, meanwhile, is set once, and the attacker keeps paying for the tokens.

Why it takes the bait

Tracebit let ten models loose in May on an AWS account with eleven decoys spread around, and in some of the runs it warned them there might be traps. In one of those runs, Claude Opus 4.7 skipped some resources because, in its words, they were “clearly canaries based on their names.” It picked another that looked less suspicious and read it. That one was a canary too. It kept going, tripped two more and reached admin anyway.

An agent looks at everything that seems valuable, and the more capable it is, the more decoys it trips. Of the runs that ended in admin, 19 in 20 had touched one before their first critical step, with about eight minutes to spare. That’s your window to cut it off, if someone is watching the alert.

The warning did slow them down: attacks that went all the way, admin plus persistence, fell from 20% to 3%. Studies with people had found something similar. More than 130 red teamers attacked a network in the Tularosa study, and what slowed them most was deception plus being told it was there.

Thinkst, the company behind Canarytokens, goes further with its Agent Provocateur, a web service the agent stumbles on while exploring the network. Instead of hiding, it strikes up a conversation. It asks what the agent plans to do next, which user it runs as or what its SSH key fingerprint is, and the agent answers. Thinkst says every agent in its internal tests took the bait, though some made their answers up, like the one that gave an SSH key that didn’t exist.

Until it looks for them

The authors of Rouxii, a pentest agent published in September, tested it with two prompts. With the plain one, it identified honeypots 19% of the time; with another that explained how a honeypot gives itself away and how to decide whether something is one, 97%. Those were classic honeypots, for SSH and industrial services, not canaries in a cloud account, but the jump gives you a sense of what changes once an agent is taught what to look for. And a trap that’s been found can turn on whoever set it. The Rouxii authors knocked one of those honeypots, a Conpot, offline without tripping the check that watches whether it’s still up.

Tracebit doesn’t claim its traps are foolproof either. The most capable models trip more decoys, but they’re also the hardest to stop. In October, Astra, one of the seven models it tested, still reached an objective in 8 of 10 runs with all nine tricks in place. In May, capable models reached admin with or without decoys, and the write-up puts it plainly: “None of this is prevention.” Tracebit also expects its research to end up in models’ training data before long.

Traps that lean on a model’s guardrails have a limit of their own, since they only work if the attacker’s model has them. Thinkst has Canarytokens built to trip them, and Haroon Meer, its founder, writes that they’re cute but not a long-term answer, because real attacks will probably come from models without any. The agent that got into Hugging Face, in fact, ran with OpenAI’s safety filters deliberately turned off. Anyone who opens the secret reads the trap’s text too, including your own agent or a colleague.

A decoy you can set this afternoon

There’s one part you can try today, because it doesn’t depend on any model. Canarytokens.org gives you a free fake kubeconfig that points at a Thinkst server, with credentials unique to you. Leave it on the laptop where your agent works or among your CI’s secrets, note in the token where you put it, and if anyone ever uses it, you get an alert by email or webhook. Pick a spot your own tools won’t load on their own, or the first alert will be one you set off. Base64-encoded, it can run past 10,000 characters; if your CI won’t take secrets that long, the documentation explains how to shorten it.

If your agent uses MCP, you can leave another decoy in its own configuration. Thinkst’s MCP Canarytoken generates an mcp.json with a server that promises credentials for other services through tools like fetch_kubeconfig, and alerts when something connects or calls one of them. Lenny Zeltser, who published the code to build one on a Cloudflare Worker, cautions that your own agent reads that same configuration, so you have to tell it not to use that entry (in Claude Code, with disabledMcpjsonServers).

Inside the cluster, a decoy Secret with a believable name plays a similar role, though nothing will alert you. Every read is recorded in the cluster’s audit log, if you have it turned on. But listing the namespace’s Secrets returns it too, and that request never names it, so searching the log for its name isn’t enough. Don’t mount it in any pod: the kubelet reads it when the pod starts and keeps watching it for as long as the pod is on the node. And when you search the audit log, filter out anything that lists Secrets every day, like your GitOps controller or your backup tool.

If you already have decoys set for your agents, write to me and tell me what they’ve caught. Picaporte Labs is one person, in Spain.