Prompt Injection in AWS Secrets Stops AI Attack Agents Cold

A canary AWS secret stopped autonomous attack agents mid-reconnaissance, using text built to trip the attacking model's own safety guardrails, per Tracebit.

Across 152 test runs against five frontier models, overall admin escalation fell from 57% to 5%. That's a bigger swing than most security controls produce, and the canary costs nothing to deploy.

The models tested were Opus 4.8, Gemini 3.1 Pro, GLM 5.2, DeepSeek 4 Pro, and Kimi K2.6. Opus 4.8 alone dropped from 93% admin access to 0%. Full compromise across all models fell from 36% to 1%, and completion of any attack path at all fell from 91% to 15%.

The secret sits idle in the AWS account until an attacker's agent reads it. At that point it both derails the model and pages the defender, so the technique doubles as a honeytoken. Bruce Schneier flagged the limit when he covered the research. It only works on agents with guardrails to trip, so a locally run, unfiltered model reads the canary as ordinary text and keeps going.