A new cybersecurity technique could stop artificial intelligence agents during an attempted hack by directing them towards subjects their own safety systems are designed to avoid.

Researchers at London-based security company Tracebit found that carefully placed text inside a fake password or login credential could trigger an AI model’s built-in restrictions and interrupt an automated cyberattack.

The method builds on a study published by Tracebit in May, when researchers gave 10 leading AI models a simulated company network containing real vulnerabilities. The systems were instructed to operate as autonomous attackers.

The network also contained decoys known as canaries. Designed to look like genuine passwords and credentials, the canaries alerted defenders when an AI agent touched them.

Across 951 attack attempts, the canaries detected activity before the AI gained administrator access in 95.9% of cases, providing a median warning of eight minutes. However, the AI took an average of 14 minutes to complete an attack, leaving defenders only a short period to understand the threat and respond.

Tracebit then tested whether it could extend that window by using the safety restrictions already built into AI systems.

The company placed short pieces of text inside fake credentials designed to steer an AI attacker towards subjects that could trigger its safety controls. Tracebit calls the technique a “context bomb”.

The approach was tailored to individual models. References to dangerous biological weapons were effective against several Western systems, while other models required different sensitive subjects.

Tracebit tested the method on five AI models, including Opus 4.8, Gemini 3.1 Pro, GLM 5.2, DeepSeek 4 Pro and Kimi K2.6. Across 152 attack attempts, the proportion of runs that reached administrator access fell from 57% to 5% when a context bomb was used.

Full compromises, defined as administrator access combined with a lasting foothold in the network, dropped from 36% to 1%. The number of attempts that completed any part of an attack fell from 91% to 15%.

Every run involving a context bomb also triggered a canary alert before the attack could proceed.

Opus 4.8 showed the sharpest change. Without the technique, it reached administrator access in 93% of tests. With a context bomb present, it failed to do so in every test.

Tracebit said the method is not a complete solution to prompt injection, a weakness in which AI systems can mistake hidden instructions for ordinary data.

Instead, the researchers see it as a second layer of defence alongside canary alerts. The earlier system gives security teams a warning, while the context bomb is designed to interrupt an AI attack before it can progress.

A U.S. robotics company developing artificial intelligence-powered humanoid robots says weaponised versions of the technology could begin testing as early as next year, following field trials in Ukraine, raising fresh questions about the future of autonomous systems in modern warfare.

Foundation Future Industries, which builds humanoid robots for commercial and military applications, has already tested its Phantom robots in Ukraine in non-combat roles. Chief Executive Officer Sankaet Pathak said the company expects to explore weaponisation after evaluating the results of those pilot programs.

Pathak said public fears are often shaped by science fiction but argued that humanoid robots would not replace existing weapons such as missiles or drones.

“I think we have this psychological reaction, which is like the Terminator, but the reality is not really like that,” he said.

Instead, he believes humanoid robots could be deployed for highly precise military operations where limiting damage to infrastructure and reducing civilian casualties are priorities.

According to Pathak, drones and conventional weapons remain more effective for large-scale attacks, while humanoid robots would be better suited to complex ground missions requiring careful movement through buildings and urban environments.

He added that robots are unlikely to replace drones on the battlefield but could help reduce risks faced by soldiers in increasingly dangerous combat zones.

Currently, there is no international treaty specifically regulating humanoid or autonomous combat robots. Their use falls under existing international humanitarian law, which requires distinction between military targets and civilians during armed conflict.

The issue has drawn increasing attention from the United Nations. Last week, UN Secretary-General António Guterres renewed calls for restrictions on lethal autonomous weapons systems, describing them as “killer robots” capable of selecting and attacking targets without human judgment. The UN has been negotiating a treaty on lethal autonomous weapons since 2023, with proposals calling for a legally binding agreement by 2026.

Pathak argued that humanoid robots should be treated similarly to other precision-guided military systems already in service, including armed drones and unmanned ground vehicles.

Foundation’s robots rely on artificial intelligence built around so-called world models. Unlike large language models that predict text, these systems learn from video, simulations and spatial information to understand physical environments and predict how objects and people move over time.

The company believes these models are essential for creating robots capable of safely navigating complex surroundings.

While concerns persist about advanced AI becoming uncontrollable, Pathak said the greater short-term threat comes from criminals or extremist groups misusing publicly available AI tools for cyberattacks, disinformation campaigns or modifying commercial drones for attacks.

He believes scenarios involving AI independently rewriting its own objectives and improving itself remain several major technological breakthroughs away.

Beyond combat, Foundation sees immediate military uses for its humanoid robots in logistics, reconnaissance and building inspections. Those capabilities have already been evaluated in Ukraine, helping shape the development of the company’s next-generation Phantom 2 robot.

The upgraded model is designed for harsh outdoor conditions, offering waterproof and dustproof protection, an increased payload capacity of around 80 kilograms and greater resistance to impacts.

Foundation currently leases Phantom robots to commercial customers for about $100,000 annually per unit, while military buyers purchase the machines at similar prices. Its investors include Eric Trump, payment company Stripe and venture capital firm Define.