Do Son 
The obfuscated vector | Image: Check Point Research
Check Point Research published a technical analysis, revealing a stealthy prompt injection method. The newly documented Puzzlemask AI attack bypasses automated language model security checks without using suspicious encoding. Instead, the technique wraps malicious instructions inside ordinary English prose. The researchers demonstrated that lightweight gatekeepers fail to detect the hidden commands entirely. Consequently, vulnerable multi-tier systems pass dangerous prompts directly to powerful backend reasoning models for execution.
Track every CVE that hits your stack the moment it's exploited.
Get free email alertsThe Split Defense Model in Modern AI Systems
Many enterprise artificial intelligence platforms use a tiered defense model to inspect user queries. In this setup, developers deploy a small, fast model to screen incoming text before deeper processing. This gatekeeper checks whether the input violates established safety guidelines. If the gatekeeper marks the prompt as benign, the system routes the request to a larger target model.
This layered design attempts to balance processing speed with security enforcement. Organizations rely on smaller models like GPT-4o mini or Claude 3 Haiku to save computational costs. Meanwhile, advanced reasoning models handle the actual user tasks. However, this design creates an asymmetric gap between the security checker and the executing engine.
How the Attack Vector Operates
The attack exploits the cognitive difference between lightweight filters and heavy reasoning engines. Unlike older jailbreaks, this method avoids emojis, Base64 strings, and invisible Unicode characters. The research report explains: “In this research we introduce a prompt-crafting technique for bypassing quick LLM-based policy checks using plain English (no emojis, base64, invisible formatting, etc.)”
Attackers embed an unauthorized command inside an automated prose wrapper. For example, the hidden instructions might demand file encryption, data exfiltration, or system compromise. The gatekeeper reads the text as an innocuous passage or literary excerpt. The report notes: “An LLM with limited resources and attention fails to realize the payload is there, classifies the prompt as benign and passes it off to the target model.”
Once the request reaches the target model, the behavior shifts dramatically. The advanced model possesses greater context awareness and analytical depth. Consequently, the target identifies the structural instructions embedded within the plain prose. The target then extracts the payload and executes the commands. The technical breakdown in the Check Point Research security report provides deeper insights into this vector. The study reveals that the attack functions as a transport wrapper rather than a direct jailbreak.
Experimental Results Across Popular Models
Check Point Research tested twenty-three automated prompts against several widely used gatekeeper systems. The team evaluated GPT-4o mini, Claude 3 Haiku, Llama-Guard 3, and gpt-oss-safeguard. Each test model operated under strict safety policies designed to catch file access or encryption requests.
The results revealed a severe blind spot in automated policy checks. The authors observed: “Gatekeeper models, in 100% of trials we ran, classified crafted prompts as safe.” The filters never realized that an embedded payload existed within the text.
Next, the researchers submitted eighteen crafted prompts to an advanced target model, GPT-5 Thinking High. The model had access to an internal Python code interpreter. In seventeen of eighteen trials, representing a 94.4 percent success rate, the target successfully decoded and executed the hidden instructions. For instance, in an emulated environment, the model encrypted local documents after recovering instructions hidden inside innocent text.
Compute Asymmetry and Tooling Requirements
The success of the Puzzlemask AI attack depends directly on computational asymmetry. Recovering the hidden payload requires substantial analytical effort. During testing, the target model consistently required over one minute of thinking time. Furthermore, the model executed multiple Python scripts to decode the embedded pattern.
Lightweight gatekeepers do not possess code interpreters or extended reasoning time. Therefore, they cannot uncover the hidden logic. Interestingly, the attack failed against Anthropic Opus-class systems. Those models feature built-in classifiers that terminate conversations when they detect obfuscated prompts during processing.
Defensive Strategies and Pipeline Hardening
Defenders must update their security architectures to neutralize this prompt injection technique. Traditional keyword matching and simple classifier prompts cannot detect payloads hidden in natural writing.
First, organizations can implement prompt paraphrasing at the intake stage. Forcing an intermediate model to rephrase user input destroys the embedded pattern. The researchers explain: “Subjecting untrusted input to paraphrasing that is, instructing an LLM to rewrite the prompt in its own terms will almost certainly remove the embedded payload from the wrapper prompt.” However, this approach adds latency and may alter prompt nuance.
Second, engineers can adjust gatekeeper system prompts. Adding explicit instructions to flag quantitative, self-referential statements helps small models identify wrapper patterns. During validation tests, this single policy adjustment allowed GPT-4o mini to intercept every test prompt.
Finally, security teams must monitor output actions and interpreter commands rather than relying solely on input screening. Inspecting the tools that a model calls provides the final line of defense against evasive prompts.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
