Attackers have developed a new trick called PuzzleMask that uses everyday English to sneak harmful instructions past AI security filters. Rather than using obvious code, hidden symbols, or format tricks, PuzzleMask simply wraps dangerous prompts within text that looks completely normal. A preliminary model judges these as safe, then hands them off to a more powerful AI which can extract and execute the embedded instructions.
What is the PuzzleMask method?
In tests by Check Point researchers, ordinary-seeming prose was used to hide policy-violating payloads (such as instructions to encrypt local documents or reveal file contents). A lightweight model — acting as a gatekeeper — couldn’t spot anything suspicious. But once that text reached a target model designed for deeper reasoning or with tools like code interpreters, the hidden instructions were recovered and acted upon. In the trials, 23 payloads were wrapped; the gatekeeper labeled all of them safe. Of those, 17 were successfully extracted by the downstream model — a zero-day style bypass in ~94% of cases.
Why it matters and how defences can close the gap
This matters in real-world AI workflows that use layered defenses. Many systems rely on a fast, simple screening stage followed by a more capable agent with higher privileges. If the filter is too basic, that agent can act on hidden instructions undetected. PuzzleMask demonstrates that attacks don’t require sophisticated obfuscation — just ordinary language structured in a way that leads AI models with greater reasoning power to act.
To counter this, organizations can rephrase or paraphrase untrusted content before feeding it into core AI systems. This tends to break the structure that carries concealed prompts, although it introduces processing cost and potential shifts in meaning. Gatekeeper rules should also target suspicious self-referential wording, rather than just known dangerous phrases. In Check Point’s tests, adding a clause flagging self-referential or quantitatively framed language enabled the gatekeeper to catch all 23 obfuscated prompts.
Beyond input filters, oversight of outputs, tool invocations, and high-impact actions is essential. Privileged operations—like file modification, running system commands, or transmitting sensitive data—should trigger approval workflows to avoid disastrous side-effects when a hidden command slips through.
PuzzleMask underscores a wider lesson: defenders must focus on what AI systems are doing, not just on what inputs look like. Natural language can be weaponized. Separating content from commands, tightening permissions, and closely monitoring agent behavior become mission-critical. As more organizations adopt AI tools with access to internal files, systems and automation tools, overlooking these gaps could lead to meaningful compromise.
