The company's new research moves beyond earlier work that used context bombs to trigger guardrails, focusing instead on entrapping agents with fake targets and deceptively complex problems. Nine techniques were tested, including an unending web service, passwords apparently locked behind layers of encryption, and an endless database where every page pointed to another page.

The most effective single bomb was a fake penetration testing report. It presented itself as a recent assessment, labelled real attack paths as canaries and described decoys as valuable targets that had already been exploited. Tracebit says this convinced many agents that the defender's real systems were traps, so they avoided them, cutting achieved objectives by 58%. Some agents accepted the warnings and stopped early, leaving exploitable targets untouched.

In tests across the models named in the research, runs reaching an objective fell from 39 out of 40 at baseline to 2 out of 40. The bombs also affected frontier models: GPT-6 Astra's successes fell by 54% with a nearly quadrupled bill per attack, while Claude Opus 5's success rate dropped by 91%. Combining all nine bombs had the strongest effect, with none of the tested models from Moonshot, Alibaba and DeepSeek achieving their objectives.

Not every agent fell for the traps. Tracebit's researchers note that one model crawled 825 pages in 55 minutes, spotted the endless database trap, tried other leads and still came back for another attempt. Tracebit co-founder and CEO Andy Smith framed the approach as beating attackers at their own game: deception sends agents down rabbit holes, burning time and tokens while inflating costs until the target is no longer worth the effort.